feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports

- Introduced a new VEX compact fixture for testing purposes.
- Implemented `verify_export.py` script to validate Findings Ledger exports, ensuring deterministic ordering and applying redaction manifests.
- Added a lightweight stub `HarnessRunner` for unit tests to validate ledger hashing expectations.
- Documented tasks related to the Mirror Creator.
- Created models for entropy signals and implemented the `EntropyPenaltyCalculator` to compute penalties based on scanner outputs.
- Developed unit tests for `EntropyPenaltyCalculator` to ensure correct penalty calculations and handling of edge cases.
- Added tests for symbol ID normalization in the reachability scanner.
- Enhanced console status service with comprehensive unit tests for connection handling and error recovery.
- Included Cosign tool version 2.6.0 with checksums for various platforms.

src/Scanner/__Tests/StellaOps.Scanner.Reachability.Tests/RichGraphWriterTests.cs

@@ -16,8 +16,8 @@ public class RichGraphWriterTests
         var union = new ReachabilityUnionGraph(
             Nodes: new[]
             {
-                new ReachabilityUnionNode("sym:dotnet:B", "dotnet", "method", display: "B"),
-                new ReachabilityUnionNode("sym:dotnet:A", "dotnet", "method", display: "A")
+                new ReachabilityUnionNode("sym:dotnet:B", "dotnet", "method", "B"),
+                new ReachabilityUnionNode("sym:dotnet:A", "dotnet", "method", "A")
             },
             Edges: new[]
             {

src/Scanner/__Tests/StellaOps.Scanner.Reachability.Tests/SymbolIdTests.cs

@@ -0,0 +1,40 @@
+using StellaOps.Scanner.Reachability;
+using Xunit;
+
+namespace StellaOps.Scanner.Reachability.Tests;
+
+public class SymbolIdTests
+{
+    [Fact]
+    public void ForBinaryAddressed_NormalizesAddressAndKeepsLinkage()
+    {
+        var id1 = SymbolId.ForBinaryAddressed("sha256:deadbeef", ".text", "0x0040", "foo", "weak");
+        var id2 = SymbolId.ForBinaryAddressed("sha256:deadbeef", ".text", "0x40", "foo", "weak");
+
+        Assert.Equal(id1, id2);
+
+        var id3 = SymbolId.ForBinaryAddressed("sha256:deadbeef", ".text", "40", "foo", "strong");
+        Assert.NotEqual(id1, id3);
+    }
+
+    [Fact]
+    public void CodeIdBinarySegment_NormalizesAddressAndLength()
+    {
+        var cid1 = CodeId.ForBinarySegment("elf", "sha256:abc", "0X0010", 64, ".text");
+        var cid2 = CodeId.ForBinarySegment("elf", "sha256:abc", "16", 64, ".text");
+
+        Assert.Equal(cid1, cid2);
+
+        var cid3 = CodeId.ForBinarySegment("elf", "sha256:abc", "0x20", 32, ".text");
+        Assert.NotEqual(cid1, cid3);
+    }
+
+    [Fact]
+    public void SymbolIdForShell_RemainsStableForSameCommand()
+    {
+        var id1 = SymbolId.ForShell("/entrypoint.sh", "python -m app");
+        var id2 = SymbolId.ForShell("/entrypoint.sh", "python -m app");
+
+        Assert.Equal(id1, id2);
+    }
+}