Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

docs/replay/TEST_STRATEGY.md

@@ -19,6 +19,7 @@ This playbook enumerates the deterministic replay validation suite. It guides th
 | T-RETENTION-006 | **Retention Sweep** | Ensure Evidence Locker prunes hot CAS after SLA while preserving cold storage copies. | Evidence Locker, Ops | Replay retention config, audit logs |
 | T-OFFLINE-007 | **Offline Kit Replay** | Execute `stella replay` using only Offline Kit artifacts. | CLI, Evidence Locker | Offline kit bundle, local RootPack |
 | T-OPA-008 | **Runbook Drill** | Simulate replay-driven incident response per `docs/runbooks/replay_ops.md`. | Ops Guild, Scanner, Authority | Runbook checklist, incident notes |
+| T-REACH-009 | **Reachability Replay** | Rehydrate reachability graphs/traces from replay bundles and compare against reachbench fixtures. | Scanner, Signals, Replay | `reachbench-2025-expanded`, reachability CAS references |
 
 ---
 
@@ -50,7 +51,8 @@ This playbook enumerates the deterministic replay validation suite. It guides th
 - [ ] Replay verification metrics ingested into Telemetry Stack dashboards.  
 - [ ] Evidence Locker retention job validated against hot/cold tiers.  
 - [ ] CLI documentation updated with troubleshooting steps observed during tests.  
-- [ ] Runbook drill logged with timestamp and owners in `docs/runbooks/replay_ops.md`.
+- [ ] Runbook drill logged with timestamp and owners in `docs/runbooks/replay_ops.md`.  
+- [ ] Reachability replay drill captured (`T-REACH-009`) with fixture references and Signals verification logs.  
 
 ---