feat: Implement runner execution pipeline with planner dispatch and execution services

- Introduced RunnerBackgroundService to handle execution of runner segments.
- Added RunnerExecutionService for processing segments and aggregating results.
- Implemented PlannerQueueDispatchService to manage dispatching of planner messages.
- Created PlannerQueueDispatcherBackgroundService for leasing and processing planner queue messages.
- Developed ScannerReportClient for interacting with the scanner service.
- Enhanced observability with SchedulerWorkerMetrics for tracking planner and runner performance.
- Added comprehensive documentation for the new runner execution pipeline and observability metrics.
- Implemented event emission for rescan activity and scanner report readiness.

src/StellaOps.Scheduler.Worker/Execution/ScannerReportClient.cs

@@ -0,0 +1,52 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Scheduler.Models;
+
+namespace StellaOps.Scheduler.Worker.Execution;
+
+public interface IScannerReportClient
+{
+    Task<RunnerImageResult> ExecuteAsync(ScannerReportRequest request, CancellationToken cancellationToken = default);
+}
+
+public sealed record ScannerReportRequest(
+    string TenantId,
+    string RunId,
+    string ImageDigest,
+    ScheduleMode Mode,
+    bool UsageOnly,
+    IReadOnlyDictionary<string, string> Attributes);
+
+public sealed record RunnerImageResult(
+    string ImageDigest,
+    DeltaSummary? Delta,
+    bool ContentRefreshed,
+    RunnerReportSnapshot Report,
+    RunnerDsseEnvelope? Dsse);
+
+public sealed record RunnerReportSnapshot(
+    string ReportId,
+    string ImageDigest,
+    string Verdict,
+    DateTimeOffset GeneratedAt,
+    RunnerReportSummary Summary,
+    string? PolicyRevisionId,
+    string? PolicyDigest);
+
+public sealed record RunnerReportSummary(
+    int Total,
+    int Blocked,
+    int Warned,
+    int Ignored,
+    int Quieted);
+
+public sealed record RunnerDsseEnvelope(
+    string PayloadType,
+    string Payload,
+    IReadOnlyList<RunnerDsseSignature> Signatures);
+
+public sealed record RunnerDsseSignature(
+    string KeyId,
+    string Algorithm,
+    string Signature);