feat: Add UI benchmark driver and scenarios for graph interactions

- Introduced `ui_bench_driver.mjs` to read scenarios and fixture manifest, generating a deterministic run plan.
- Created `ui_bench_plan.md` outlining the purpose, scope, and next steps for the benchmark.
- Added `ui_bench_scenarios.json` containing various scenarios for graph UI interactions.
- Implemented tests for CLI commands, ensuring bundle verification and telemetry defaults.
- Developed schemas for orchestrator components, including replay manifests and event envelopes.
- Added mock API for risk management, including listing and statistics functionalities.
- Implemented models for risk profiles and query options to support the new API.

src/Cli/__Tests/StellaOps.Cli.Tests/Commands/ScannerDownloadVerifyTests.cs

@@ -0,0 +1,60 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging.Abstractions;
+using StellaOps.Cli.Commands;
+using Xunit;
+
+namespace StellaOps.Cli.Tests.Commands;
+
+public sealed class ScannerDownloadVerifyTests
+{
+    [Fact]
+    public async Task VerifyBundleAsync_Succeeds_WhenHashMatches()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+
+        var hash = Convert.ToHexString(System.Security.Cryptography.SHA256.HashData(File.ReadAllBytes(bundle))).ToLowerInvariant();
+        await File.WriteAllTextAsync(bundle + ".sha256", hash);
+
+        await CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task VerifyBundleAsync_Throws_WhenHashMismatch()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+        await File.WriteAllTextAsync(bundle + ".sha256", "deadbeef");
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task VerifyBundleAsync_Throws_WhenChecksumMissing()
+    {
+        var tmp = Path.Combine(Path.GetTempPath(), $"stellaops-cli-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tmp);
+        var bundle = Path.Combine(tmp, "scanner.tgz");
+        await File.WriteAllTextAsync(bundle, "hello");
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            CommandHandlersTestShim.VerifyBundlePublicAsync(bundle, NullLogger.Instance, CancellationToken.None));
+    }
+}
+
+internal static class CommandHandlersTestShim
+{
+    public static Task VerifyBundlePublicAsync(string path, ILogger logger, CancellationToken token)
+        => typeof(CommandHandlers)
+            .GetMethod(\"VerifyBundleAsync\", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Static)!
+            .Invoke(null, new object[] { path, logger, token }) as Task
+            ?? Task.CompletedTask;
+}