Implement ledger metrics for observability and add tests for Ruby packages endpoints

- Added `LedgerMetrics` class to record write latency and total events for ledger operations.
- Created comprehensive tests for Ruby packages endpoints, covering scenarios for missing inventory, successful retrieval, and identifier handling.
- Introduced `TestSurfaceSecretsScope` for managing environment variables during tests.
- Developed `ProvenanceMongoExtensions` for attaching DSSE provenance and trust information to event documents.
- Implemented `EventProvenanceWriter` and `EventWriter` classes for managing event provenance in MongoDB.
- Established MongoDB indexes for efficient querying of events based on provenance and trust.
- Added models and JSON parsing logic for DSSE provenance and trust information.

docs/notifications/rules.md

@@ -81,11 +81,24 @@ Each rule requires at least one action. Actions are deduplicated and sorted by `
 | `throttle` | ISO8601 duration? | Optional throttle TTL (`PT300S`, `PT1H`). Prevents duplicate deliveries when the same idempotency hash appears before expiry. |
 | `locale` | string? | BCP-47 tag (stored lower-case). Template lookup falls back to channel locale then `en-us`. |
 | `enabled` | bool | Disabled actions skip rendering but remain stored. |
-| `metadata` | map<string,string> | Connector-specific hints (priority, layout, etc.). |
-
-### 4.1 Evaluation order
-
-1. Verify channel exists and is enabled; disabled channels mark the delivery as `Dropped`.
+| `metadata` | map<string,string> | Connector-specific hints (priority, layout, etc.). |
+
+### 4.0 Attestation lifecycle templates
+
+Rules targeting attestation/signing events (`attestor.verification.failed`, `attestor.attestation.expiring`, `authority.keys.revoked`, `attestor.transparency.anomaly`) must reference the dedicated template keys documented in [`notifications/templates.md` §7](templates.md#7-attestation--signing-lifecycle-templates-notify-attest-74-001) so payloads remain deterministic across channels and Offline Kits:
+
+| Event kind | Required template key | Notes |
+| --- | --- | --- |
+| `attestor.verification.failed` | `tmpl-attest-verify-fail` | Include failure code, Rekor UUID/index, last good attestation link. |
+| `attestor.attestation.expiring` | `tmpl-attest-expiry-warning` | Surface issued/expires timestamps, time remaining, renewal instructions. |
+| `authority.keys.revoked` / `authority.keys.rotated` | `tmpl-attest-key-rotation` | List rotation batch ID, impacted services, remediation steps. |
+| `attestor.transparency.anomaly` | `tmpl-attest-transparency-anomaly` | Highlight Rekor/witness metadata and anomaly classification. |
+
+Locale-specific variants keep the same template key while varying `locale`; rule actions shouldn't create ad-hoc templates for these events.
+
+### 4.1 Evaluation order
+
+1. Verify channel exists and is enabled; disabled channels mark the delivery as `Dropped`.
 2. Apply throttle idempotency key: `hash(ruleId|actionId|event.kind|scope.digest|delta.hash|dayBucket)`. Hits are logged as `Throttled`.
 3. If the action defines a digest window other than `instant`, append the event to the open window and defer delivery until flush.
 4. When delivery proceeds, the renderer resolves the template, locale, and metadata before invoking the connector.