feat: Add UI benchmark driver and scenarios for graph interactions

- Introduced `ui_bench_driver.mjs` to read scenarios and fixture manifest, generating a deterministic run plan.
- Created `ui_bench_plan.md` outlining the purpose, scope, and next steps for the benchmark.
- Added `ui_bench_scenarios.json` containing various scenarios for graph UI interactions.
- Implemented tests for CLI commands, ensuring bundle verification and telemetry defaults.
- Developed schemas for orchestrator components, including replay manifests and event envelopes.
- Added mock API for risk management, including listing and statistics functionalities.
- Implemented models for risk profiles and query options to support the new API.

ops/devops/telemetry/tests/manifest-valid.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "1.0.0",
+  "bundleId": "00000000-0000-0000-0000-000000000001",
+  "createdAt": "2025-12-01T00:00:00Z",
+  "profileHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "collectorVersion": "otelcol/1.0.0",
+  "sealedMode": true,
+  "redactionManifest": "redaction-manifest.json",
+  "manifestHashAlgorithm": "sha256",
+  "timeAnchor": {
+    "type": "rfc3161",
+    "value": "dummy-token"
+  },
+  "artifacts": [
+    {
+      "path": "logs.ndjson",
+      "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "mediaType": "application/x-ndjson",
+      "size": 123
+    }
+  ],
+  "dsseEnvelope": {
+    "hash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+    "location": "bundle.dsse.json"
+  }
+}

ops/devops/telemetry/tests/telemetry-bundle.sha256

@@ -0,0 +1 @@
+6e3fedbf183aece5dfa14a90ebce955e2887d36747c424e628dc2cc03bcb0ed3  ops/devops/telemetry/tests/manifest-valid.json

ops/devops/telemetry/verify-telemetry-bundle.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Minimal offline verifier for telemetry bundles (v1)
+# Exits:
+#  0  success
+#  21 checksum/manifest missing
+#  22 checksum mismatch
+#  23 schema validation failed
+
+BUNDLE=${1:-}
+if [[ -z "$BUNDLE" ]]; then
+  echo "Usage: $0 path/to/telemetry-bundle.tar" >&2
+  exit 64
+fi
+
+WORKDIR=$(mktemp -d)
+cleanup() { rm -rf "$WORKDIR"; }
+trap cleanup EXIT
+
+tar --extract --file "$BUNDLE" --directory "$WORKDIR"
+
+MANIFEST="$WORKDIR/telemetry-bundle.json"
+HASHES="$WORKDIR/telemetry-bundle.sha256"
+
+if [[ ! -f "$MANIFEST" || ! -f "$HASHES" ]]; then
+  echo "Missing manifest or checksum file." >&2
+  exit 21
+fi
+
+# Verify checksums
+pushd "$WORKDIR" >/dev/null
+if ! sha256sum --quiet --check telemetry-bundle.sha256; then
+  echo "Checksum mismatch." >&2
+  exit 22
+fi
+popd >/dev/null
+
+# JSON schema validation (optional if jsonschema not present).
+if command -v python >/dev/null 2>&1; then
+  SCHEMA_DIR="$(cd "$(dirname "$0")/../../docs/modules/telemetry/schemas" && pwd)"
+  SCHEMA_FILE="$SCHEMA_DIR/telemetry-bundle.schema.json"
+  if [[ -f "$SCHEMA_FILE" ]]; then
+    python - "$MANIFEST" "$SCHEMA_FILE" <<'PY'
+import json, sys
+from jsonschema import validate, Draft202012Validator
+
+manifest_path = sys.argv[1]
+schema_path = sys.argv[2]
+with open(manifest_path, 'r', encoding='utf-8') as f:
+    manifest = json.load(f)
+with open(schema_path, 'r', encoding='utf-8') as f:
+    schema = json.load(f)
+Draft202012Validator.check_schema(schema)
+validate(manifest, schema)
+PY
+    if [[ $? -ne 0 ]]; then
+      echo "Schema validation failed." >&2
+      exit 23
+    fi
+  else
+    echo "Schema file not found ($SCHEMA_FILE); skipping validation." >&2
+  fi
+else
+  echo "jsonschema validation skipped (requires python + jsonschema)." >&2
+fi
+
+echo "Telemetry bundle verified." >&2
+exit 0