Add unit and integration tests for VexCandidateEmitter and SmartDiff repositories

- Implemented comprehensive unit tests for VexCandidateEmitter to validate candidate emission logic based on various scenarios including absent and present APIs, confidence thresholds, and rate limiting.
- Added integration tests for SmartDiff PostgreSQL repositories, covering snapshot storage and retrieval, candidate storage, and material risk change handling.
- Ensured tests validate correct behavior for storing, retrieving, and querying snapshots and candidates, including edge cases and expected outcomes.

src/AirGap/AGENTS.md

@@ -7,7 +7,7 @@
 - **Controller engineer (ASP.NET Core)**: seal/unseal state machine, status APIs, Authority scope enforcement.
 - **Importer engineer**: bundle verification (TUF/DSSE), catalog repositories, object-store loaders.
 - **Time engineer**: time anchor parsing/verification (Roughtime, RFC3161), staleness calculators.
-- **QA/Automation**: API + storage tests (Mongo2Go/in-memory), deterministic ordering, sealed/offline paths.
+- **QA/Automation**: API + storage tests (Testcontainers/in-memory), deterministic ordering, sealed/offline paths.
 - **Docs/Runbooks**: keep air-gap ops guides, scaffolds, and schemas aligned with behavior.
 
 ## Required Reading (treat as read before DOING)
@@ -33,10 +33,9 @@
 - Cross-module edits require sprint note; otherwise stay within `src/AirGap`.
 
 ## Testing Rules
-- Use Mongo2Go/in-memory stores; no network.
+- Use Testcontainers (PostgreSQL)/in-memory stores; no network.
 - Cover sealed/unsealed transitions, staleness budgets, trust-root failures, deterministic ordering.
 - API tests via WebApplicationFactory; importer tests use local fixture bundles (no downloads).
-- If Mongo2Go fails to start (OpenSSL 1.1 missing), see `tests/AirGap/README.md` for the shim note.
 
 ## Delivery Discipline
 - Update sprint tracker statuses (`TODO → DOING → DONE/BLOCKED`); log decisions in Execution Log and Decisions & Risks.