Implement Advisory Canonicalization and Backfill Migration

- Added AdvisoryCanonicalizer for canonicalizing advisory identifiers.
- Created EnsureAdvisoryCanonicalKeyBackfillMigration to populate advisory_key and links in advisory_raw documents.
- Introduced FileSurfaceManifestStore for managing surface manifests with file system backing.
- Developed ISurfaceManifestReader and ISurfaceManifestWriter interfaces for reading and writing manifests.
- Implemented SurfaceManifestPathBuilder for constructing paths and URIs for surface manifests.
- Added tests for FileSurfaceManifestStore to ensure correct functionality and deterministic behavior.
- Updated documentation for new features and migration steps.

src/Concelier/StellaOps.Concelier.WebService/Program.cs

@@ -672,6 +672,59 @@ if (authorityConfigured)
     advisoryRawProvenanceEndpoint.RequireAuthorization(AdvisoryReadPolicyName);
 }
 
+var advisoryEvidenceEndpoint = app.MapGet("/vuln/evidence/advisories/{advisoryKey}", async (
+    string advisoryKey,
+    HttpContext context,
+    [FromServices] IAdvisoryRawService rawService,
+    CancellationToken cancellationToken) =>
+{
+    ApplyNoCache(context.Response);
+
+    if (!TryResolveTenant(context, requireHeader: false, out var tenant, out var tenantError))
+    {
+        return tenantError;
+    }
+
+    var authorizationError = EnsureTenantAuthorized(context, tenant);
+    if (authorizationError is not null)
+    {
+        return authorizationError;
+    }
+
+    if (string.IsNullOrWhiteSpace(advisoryKey))
+    {
+        return Problem(context, "advisoryKey is required", StatusCodes.Status400BadRequest, ProblemTypes.Validation, "Provide an advisory identifier.");
+    }
+
+    var vendorFilter = AdvisoryRawRequestMapper.NormalizeStrings(context.Request.Query["vendor"]);
+    var records = await rawService.FindByAdvisoryKeyAsync(
+        tenant,
+        advisoryKey,
+        vendorFilter,
+        cancellationToken).ConfigureAwait(false);
+
+    if (records.Count == 0)
+    {
+        return Results.NotFound();
+    }
+
+    var recordResponses = records
+        .Select(record => new AdvisoryRawRecordResponse(
+            record.Id,
+            record.Document.Tenant,
+            record.IngestedAt,
+            record.CreatedAt,
+            record.Document))
+        .ToArray();
+
+    var response = new AdvisoryEvidenceResponse(recordResponses[0].Document.AdvisoryKey, recordResponses);
+    return JsonResult(response);
+});
+if (authorityConfigured)
+{
+    advisoryEvidenceEndpoint.RequireAuthorization(AdvisoryReadPolicyName);
+}
+
 var aocVerifyEndpoint = app.MapPost("/aoc/verify", async (
     HttpContext context,
     AocVerifyRequest request,