feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports

- Introduced a new VEX compact fixture for testing purposes.
- Implemented `verify_export.py` script to validate Findings Ledger exports, ensuring deterministic ordering and applying redaction manifests.
- Added a lightweight stub `HarnessRunner` for unit tests to validate ledger hashing expectations.
- Documented tasks related to the Mirror Creator.
- Created models for entropy signals and implemented the `EntropyPenaltyCalculator` to compute penalties based on scanner outputs.
- Developed unit tests for `EntropyPenaltyCalculator` to ensure correct penalty calculations and handling of edge cases.
- Added tests for symbol ID normalization in the reachability scanner.
- Enhanced console status service with comprehensive unit tests for connection handling and error recovery.
- Included Cosign tool version 2.6.0 with checksums for various platforms.

scripts/mirror/sign_thin_bundle.py

@@ -11,6 +11,7 @@ Usage:
 
 Writes:
   - mirror-thin-v1.manifest.dsse.json
+  - mirror-thin-v1.bundle.dsse.json (optional, when --bundle is provided)
   - updates signatures in root.json, targets.json, snapshot.json, timestamp.json
 """
 import argparse, base64, json, pathlib, hashlib
@@ -46,6 +47,7 @@ def main():
     ap.add_argument("--manifest", required=True, type=pathlib.Path)
     ap.add_argument("--tar", required=True, type=pathlib.Path)
     ap.add_argument("--tuf-dir", required=True, type=pathlib.Path)
+    ap.add_argument("--bundle", required=False, type=pathlib.Path)
     args = ap.parse_args()
 
     key = load_key(args.key)
@@ -62,11 +64,23 @@ def main():
     dsse_path = args.manifest.with_suffix(".dsse.json")
     write_json(dsse_path, dsse)
 
+    if args.bundle:
+        bundle_bytes = args.bundle.read_bytes()
+        bundle_sig = sign_bytes(key, bundle_bytes)
+        bundle_dsse = {
+            "payloadType": "application/vnd.stellaops.mirror.bundle+json",
+            "payload": b64url(bundle_bytes),
+            "signatures": [{"keyid": keyid, "sig": b64url(bundle_sig)}],
+        }
+        bundle_dsse_path = args.bundle.with_suffix(".dsse.json")
+        write_json(bundle_dsse_path, bundle_dsse)
+
     # update TUF metadata
     for name in ["root.json", "targets.json", "snapshot.json", "timestamp.json"]:
         sign_tuf(args.tuf_dir / name, keyid, key)
 
-    print(f"Signed DSSE + TUF using keyid {keyid}; DSSE -> {dsse_path}")
+    extra = f", bundle DSSE -> {bundle_dsse_path}" if args.bundle else ""
+    print(f"Signed DSSE + TUF using keyid {keyid}; DSSE -> {dsse_path}{extra}")
 
 if __name__ == "__main__":
     main()