feat: Add UI benchmark driver and scenarios for graph interactions

- Introduced `ui_bench_driver.mjs` to read scenarios and fixture manifest, generating a deterministic run plan.
- Created `ui_bench_plan.md` outlining the purpose, scope, and next steps for the benchmark.
- Added `ui_bench_scenarios.json` containing various scenarios for graph UI interactions.
- Implemented tests for CLI commands, ensuring bundle verification and telemetry defaults.
- Developed schemas for orchestrator components, including replay manifests and event envelopes.
- Added mock API for risk management, including listing and statistics functionalities.
- Implemented models for risk profiles and query options to support the new API.

src/Scanner/__Tests/StellaOps.Scanner.Emit.Tests/Composition/CycloneDxComposerTests.cs

@@ -79,8 +79,9 @@ public sealed class CycloneDxComposerTests
         Assert.Equal(first.Inventory.ContentHash, first.Inventory.JsonSha256);
         Assert.Equal(first.Inventory.ProtobufSha256, second.Inventory.ProtobufSha256);
         Assert.Equal(first.Inventory.SerialNumber, second.Inventory.SerialNumber);
-        Assert.Null(first.Inventory.MerkleRoot);
+        Assert.False(string.IsNullOrWhiteSpace(first.Inventory.MerkleRoot));
         Assert.Null(first.Inventory.CompositionUri);
+        Assert.Null(first.Inventory.CompositionRecipeUri);
 
         Assert.NotNull(first.Usage);
         Assert.NotNull(second.Usage);
@@ -88,8 +89,15 @@ public sealed class CycloneDxComposerTests
         Assert.Equal(first.Usage.ContentHash, first.Usage.JsonSha256);
         Assert.Equal(first.Usage.ProtobufSha256, second.Usage.ProtobufSha256);
         Assert.Equal(first.Usage.SerialNumber, second.Usage.SerialNumber);
-        Assert.Null(first.Usage.MerkleRoot);
+        Assert.False(string.IsNullOrWhiteSpace(first.Usage.MerkleRoot));
         Assert.Null(first.Usage.CompositionUri);
+        Assert.Null(first.Usage.CompositionRecipeUri);
+
+        Assert.Equal(first.Inventory.MerkleRoot, first.Usage.MerkleRoot);
+        Assert.Equal(first.Inventory.MerkleRoot, result.CompositionRecipeSha256);
+        Assert.Equal(first.Inventory.ContentHash.Length, first.Inventory.MerkleRoot!.Length);
+        Assert.Equal(result.CompositionRecipeSha256.Length, 64);
+        Assert.NotEmpty(result.CompositionRecipeJson);
     }
 
     private static SbomCompositionRequest BuildRequest()

src/Scanner/__Tests/StellaOps.Scanner.Emit.Tests/Packaging/ScannerArtifactPackageBuilderTests.cs

@@ -64,16 +64,16 @@ public sealed class ScannerArtifactPackageBuilderTests
         var packageBuilder = new ScannerArtifactPackageBuilder();
         var package = packageBuilder.Build(request.Image.ImageDigest, request.GeneratedAt, composition, bomIndex);
 
-        Assert.Equal(5, package.Artifacts.Length); // inventory JSON+PB, usage JSON+PB, index
-
-        var kinds = package.Manifest.Artifacts.Select(entry => entry.Kind).ToArray();
-        Assert.Equal(new[] { "bom-index", "sbom-inventory", "sbom-inventory", "sbom-usage", "sbom-usage" }, kinds);
-
-        var manifestJson = package.Manifest.ToJsonBytes();
-        using var document = JsonDocument.Parse(manifestJson);
-        var root = document.RootElement;
-        Assert.Equal("sha256:image", root.GetProperty("imageDigest").GetString());
-        Assert.Equal(5, root.GetProperty("artifacts").GetArrayLength());
+        Assert.Equal(6, package.Artifacts.Length); // inventory JSON+PB, usage JSON+PB, index, composition recipe
+
+        var kinds = package.Manifest.Artifacts.Select(entry => entry.Kind).ToArray();
+        Assert.Equal(new[] { "bom-index", "composition-recipe", "sbom-inventory", "sbom-inventory", "sbom-usage", "sbom-usage" }, kinds);
+
+        var manifestJson = package.Manifest.ToJsonBytes();
+        using var document = JsonDocument.Parse(manifestJson);
+        var root = document.RootElement;
+        Assert.Equal("sha256:image", root.GetProperty("imageDigest").GetString());
+        Assert.Equal(6, root.GetProperty("artifacts").GetArrayLength());
 
         var usageEntry = root.GetProperty("artifacts").EnumerateArray().First(element => element.GetProperty("kind").GetString() == "sbom-usage");
         Assert.Equal("application/vnd.cyclonedx+json; version=1.6; view=usage", usageEntry.GetProperty("mediaType").GetString());