Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

docs/modules/devops/architecture.md

@@ -75,9 +75,10 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
 ### 2.4 Gates & tests
 
 * **Static**: linters, codegen checks, protobuf API freeze (backward‑compat tests).
-* **Unit/integration**: per‑component, plus **end‑to‑end** flows (scan→vex→policy→sign→attest).
-* **Perf SLOs**: hot paths (SBOM compose, diff, export) measured against budgets.
-* **Security**: dependency audit vs Concelier export; container hardening tests; minimal caps.
+* **Unit/integration**: per-component, plus **end-to-end** flows (scan→vex→policy→sign→attest).
+* **Perf SLOs**: hot paths (SBOM compose, diff, export) measured against budgets.
+* **Security**: dependency audit vs Concelier export; container hardening tests; minimal caps.
+* **Deployment assets**: `Build Test Deploy` workflow’s `profile-validation` job installs Helm and runs `helm lint` + `helm template` against `deploy/helm/stellaops` for every `values*.yaml`, catching ConfigMap/templating drift before merges.
 * **Analyzer smoke**: restart-time language plug-ins (currently Python) verified via `dotnet run --project src/Tools/LanguageAnalyzerSmoke` to ensure manifest integrity plus cold vs warm determinism (< 30 s / < 5 s budgets); the harness logs deviations from repository goldens for follow-up.
 * **Canary cohort**: internal staging + selected customers; one week on **edge** before **stable** tag.