feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports

- Introduced a new VEX compact fixture for testing purposes.
- Implemented `verify_export.py` script to validate Findings Ledger exports, ensuring deterministic ordering and applying redaction manifests.
- Added a lightweight stub `HarnessRunner` for unit tests to validate ledger hashing expectations.
- Documented tasks related to the Mirror Creator.
- Created models for entropy signals and implemented the `EntropyPenaltyCalculator` to compute penalties based on scanner outputs.
- Developed unit tests for `EntropyPenaltyCalculator` to ensure correct penalty calculations and handling of edge cases.
- Added tests for symbol ID normalization in the reachability scanner.
- Enhanced console status service with comprehensive unit tests for connection handling and error recovery.
- Included Cosign tool version 2.6.0 with checksums for various platforms.

docs/modules/zastava/schemas/observer_event.schema.json

@@ -1,8 +1,67 @@
 {
   "$id": "https://stella-ops.org/schemas/zastava/observer_event.schema.json",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Zastava Observer Event",
-  "type": "object",
+  "properties": {
+    "event_type": {
+      "enum": [
+        "runtime_fact",
+        "drift",
+        "policy_violation",
+        "heartbeat"
+      ]
+    },
+    "firmware_version": {
+      "minLength": 1,
+      "type": "string"
+    },
+    "graph_revision_id": {
+      "minLength": 1,
+      "type": "string"
+    },
+    "ledger_id": {
+      "type": "string"
+    },
+    "monotonic_nanos": {
+      "type": "integer"
+    },
+    "observed_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "payload": {
+      "description": "Canonical runtime payload (JCS) used for hashing.",
+      "type": "object"
+    },
+    "payload_hash": {
+      "description": "sha256 over canonical JSON (JCS) of payload",
+      "pattern": "^sha256:[0-9a-f]{64}$",
+      "type": "string"
+    },
+    "policy_hash": {
+      "minLength": 1,
+      "type": "string"
+    },
+    "project_id": {
+      "minLength": 1,
+      "type": "string"
+    },
+    "replay_manifest": {
+      "type": "string"
+    },
+    "sensor_id": {
+      "minLength": 1,
+      "type": "string"
+    },
+    "signature": {
+      "description": "DSSE envelope reference",
+      "pattern": "^dsse://[A-Za-z0-9._:/-]+$",
+      "type": "string"
+    },
+    "tenant_id": {
+      "minLength": 1,
+      "type": "string"
+    }
+  },
   "required": [
     "tenant_id",
     "project_id",
@@ -12,23 +71,10 @@
     "graph_revision_id",
     "event_type",
     "observed_at",
+    "payload",
     "payload_hash",
-    "signature" 
+    "signature"
   ],
-  "properties": {
-    "tenant_id": { "type": "string" },
-    "project_id": { "type": "string" },
-    "sensor_id": { "type": "string" },
-    "firmware_version": { "type": "string" },
-    "policy_hash": { "type": "string" },
-    "graph_revision_id": { "type": "string" },
-    "ledger_id": { "type": "string" },
-    "replay_manifest": { "type": "string" },
-    "event_type": { "enum": ["runtime_fact", "drift", "policy_violation", "heartbeat"] },
-    "observed_at": { "type": "string", "format": "date-time" },
-    "monotonic_nanos": { "type": "integer" },
-    "payload": { "type": "object" },
-    "payload_hash": { "type": "string", "description": "sha256 over canonical JSON (JCS) of payload" },
-    "signature": { "type": "string", "description": "DSSE envelope reference" }
-  }
+  "title": "Zastava Observer Event",
+  "type": "object"
 }