Add unit tests for PackRunAttestation and SealedInstallEnforcer

- Implement comprehensive tests for PackRunAttestationService, covering attestation generation, verification, and event emission.
- Add tests for SealedInstallEnforcer to validate sealed install requirements and enforcement logic.
- Introduce a MonacoLoaderService stub for testing purposes to prevent Monaco workers/styles from loading during Karma runs.

docs/api/console/workspaces.md

@@ -309,3 +309,43 @@ data: {
 - `docs/api/console/samples/vex-statement-sse.ndjson` – contains 5 chronological SSE events for screenshot reproduction.
 
 > Until backend implementations ship, use the examples above to unblock DOCS-AIAI-31-004; replace them with live captures once the gateway endpoints are available in staging.
+
+## Exports (draft contract)
+
+Routes
+- `POST /console/exports` — start an evidence bundle export job.
+- `GET /console/exports/{exportId}` — fetch job status and download locations.
+- `GET /console/exports/{exportId}/events` — SSE stream of job progress (optional).
+
+Headers
+- `Authorization: Bearer <token>`
+- `X-StellaOps-Tenant: <tenantId>`
+- `Idempotency-Key: <uuid>` (recommended for POST)
+- `Accept: application/json` (status) or `text/event-stream` (events)
+
+Request body (POST /console/exports)
+- `scope`: `{ tenantId, projectId? }`
+- `sources`: array of `{ type: "advisory"|"vex"|"policy"|"scan", ids: string[] }`
+- `formats`: array of `"json"|"csv"|"ndjson"|"pdf"`
+- `attestations`: `{ include: boolean, sigstoreBundle?: boolean }`
+- `notify`: `{ webhooks?: string[], email?: string[] }`
+- `priority`: `"low"|"normal"|"high"`
+
+Responses
+- `202 Accepted` with `exportId`, `status: queued|running|succeeded|failed|expired`, `estimateSeconds`, `retryAfter`.
+- Status payload includes presigned download URLs, checksum manifest, and error list when failed.
+- SSE events emit `started`, `progress` (percent, item counts), `asset_ready` (uri, sha256), `completed`, `failed` (code, message).
+
+Proposed limits
+- Max request body 256 KiB; max sources 50; max outputs 1000 assets/export.
+- Default job timeout 30 minutes; idle SSE timeout 60s; backoff header `Retry-After`.
+
+Samples (draft)
+- Request: `docs/api/console/samples/console-export-request.json`
+- Status: `docs/api/console/samples/console-export-status.json`
+- Manifest: `docs/api/console/samples/console-export-manifest.json`
+- Events: `docs/api/console/samples/console-export-events.ndjson`
+
+Open items (needs owner sign-off)
+- Final schema (fields, limits, error codes), checksum manifest format, attestation options.
+- Caching/tie-break rules for downstream `/console/search` and `/console/downloads`.