Add sample proof bundle configurations and verification script

- Introduced sample proof bundle configuration files for testing, including `sample-proof-bundle-config.dsse.json`, `sample-proof-bundle.dsse.json`, and `sample-proof-bundle.json`.
- Implemented a verification script `test_verify_sample.sh` to validate proof bundles against specified schemas and catalogs.
- Updated existing proof bundle configurations with new metadata, including versioning, created timestamps, and justification details.
- Enhanced evidence entries with expiration dates and hashes for better integrity checks.
- Ensured all new configurations adhere to the defined schema for consistency and reliability in testing.

docs/modules/sbomservice/architecture.md

@@ -15,6 +15,8 @@
   - `sbom_snapshots` (immutable versions; tenant + artifact + digest + createdAt)
   - `sbom_projections` (materialised views keyed by snapshotId, entrypoint/service node flags)
   - `sbom_assets` (asset metadata, criticality/owner/env/exposure; append-only history)
+  - `sbom_catalog` (console catalog surface; indexed by artifact, scope, license, assetTags.*, createdAt for deterministic pagination)
+  - `sbom_component_neighbors` (component lookup graph edges; indexed by purl+artifact for cursor pagination)
 - `sbom_paths` (resolved dependency paths with runtime flags, blast-radius hints)
 - `sbom_events` (outbox for event delivery + watermark/backfill tracking)
 
@@ -84,7 +86,12 @@ Operational rules:
 - Logs: structured, include tenant + artifact digest + sbomVersion; classify ingest failures (schema, storage, orchestrator, validation).
 - Alerts: backlog thresholds for outbox/event delivery; high latency on path/timeline endpoints.
 
-## 9) Open questions / dependencies
+## 9) Configuration (Mongo-backed catalog & lookup)
+- Enable Mongo storage for `/console/sboms` and `/components/lookup` by setting `SbomService:Mongo:ConnectionString` (env: `SBOM_SbomService__Mongo__ConnectionString`).
+- Optional overrides: `SbomService:Mongo:Database`, `SbomService:Mongo:CatalogCollection`, `SbomService:Mongo:ComponentLookupCollection`; defaults are `sbom_service`, `sbom_catalog`, `sbom_component_neighbors`.
+- When the connection string is absent the service falls back to fixture JSON or deterministic in-memory seeds to keep air-gapped workflows alive.
+
+## 10) Open questions / dependencies
 - Confirm orchestrator pause/backfill contract (shared with Runtime & Signals 140-series).
 - Finalise storage collection names and indexes (compound on tenant+artifactDigest+version, TTL for transient staging).
 - Publish canonical LNM v1 fixtures and JSON schemas for projections and asset metadata.