feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

docs/ARCHITECTURE_SCANNER.md

@@ -190,6 +190,12 @@ When `scanner.events.enabled = true`, the WebService serialises the signed repor
 * **rpm**: `/var/lib/rpm/Packages` (via librpm or parser)
 * Record `name`, `version` (epoch/revision), `arch`, source package where present, and **declared file lists**.
 
+> **Data flow note:** Each OS analyzer now writes its canonical output into the shared `ScanAnalysisStore` under
+> `analysis.os.packages` (raw results), `analysis.os.fragments` (per-analyzer layer fragments), and contributes to
+> `analysis.layers.fragments` (the aggregated view consumed by emit/diff pipelines). Helpers in
+> `ScanAnalysisCompositionBuilder` convert these fragments into SBOM composition requests and component graphs so the
+> diff/emit stages no longer reach back into individual analyzer implementations.
+
 **B) Language ecosystems (installed state only)**
 
 * **Java**: `META-INF/maven/*/pom.properties`, MANIFEST → `pkg:maven/...`
@@ -206,6 +212,9 @@ When `scanner.events.enabled = true`, the WebService serialises the signed repor
 * **ELF**: parse `PT_INTERP`, `DT_NEEDED`, RPATH/RUNPATH, **GNU symbol versions**; map **SONAMEs** to file paths; link executables → libs.
 * **PE/Mach‑O** (planned M2): import table, delay‑imports; version resources; code signatures.
 * Map libs back to **OS packages** if possible (via file lists); else emit `bin:{sha256}` components.
+* The exported metadata (`stellaops.os.*` properties, license list, source package) feeds policy scoring and export pipelines
+  directly – Policy evaluates quiet rules against package provenance while Exporters forward the enriched fields into
+  downstream JSON/Trivy payloads.
 
 **D) EntryTrace (ENTRYPOINT/CMD → terminal program)**