feat(graph): introduce graph.inspect.v1 contract and schema for SBOM relationships

- Added graph.inspect.v1 documentation outlining payload structure and determinism rules.
- Created JSON schema for graph.inspect.v1 to enforce payload validation.
- Defined mapping rules for graph relationships, advisories, and VEX statements.

feat(notifications): establish remediation blueprint for gaps NR1-NR10

- Documented requirements, evidence, and tests for Notifier runtime.
- Specified deliverables and next steps for addressing identified gaps.

docs(notifications): organize operations and schemas documentation

- Created README files for operations, schemas, and security notes to clarify deliverables and policies.

feat(advisory): implement PostgreSQL caching for Link-Not-Merge linksets

- Created database schema for advisory linkset cache.
- Developed repository for managing advisory linkset cache operations.
- Added tests to ensure correct functionality of the AdvisoryLinksetCacheRepository.

docs/modules/export-center/cli.md

@@ -144,16 +144,20 @@ stella export provenance run-20251029-01 --output manifests/provenance.json
 
 Retrieves the signed provenance file. `--signature` behaves like the manifest command.
 
-### 4.4 `stella export verify`
-
-```
-stella export verify run-20251029-01 \
-  --manifest manifests/export.json \
-  --provenance manifests/provenance.json \
-  --key keys/acme-export.pub
-```
-
-Wrapper around `cosign verify`. Returns exit `0` when signatures and digests validate. Exit `20` when verification fails.
+### 4.4 `stella export verify`
+
+```
+stella export verify run-20251029-01 \
+  --manifest manifests/export.json \
+  --provenance manifests/provenance.json \
+  --key keys/acme-export.pub
+```
+
+Wrapper around `cosign verify`. Returns exit `0` when signatures and digests validate. Exit `20` when verification fails.
+
+Integrity and determinism checks (EC1–EC10):
+- `stella export manifest` and `provenance` commands emit `Digest`/`X-Stella-Signature` headers; cache them for rerun-hash validation.
+- Offline kits: run `docs/modules/export-center/operations/verify-export-kit.sh <kit_dir>` to assert rerunHash, integrity headers vs OCI annotations, quotas/backpressure block, approvals, and log metadata in provenance.
 
 ## 5. CI recipe (GitHub Actions example)