feat: Implement Runtime Facts ingestion service and NDJSON reader

- Added RuntimeFactsNdjsonReader for reading NDJSON formatted runtime facts.
- Introduced IRuntimeFactsIngestionService interface and its implementation.
- Enhanced Program.cs to register new services and endpoints for runtime facts.
- Updated CallgraphIngestionService to include CAS URI in stored artifacts.
- Created RuntimeFactsValidationException for validation errors during ingestion.
- Added tests for RuntimeFactsIngestionService and RuntimeFactsNdjsonReader.
- Implemented SignalsSealedModeMonitor for compliance checks in sealed mode.
- Updated project dependencies for testing utilities.

src/Cli/StellaOps.Cli/Commands/CommandFactory.cs

@@ -28,14 +28,15 @@ internal static class CommandFactory
         {
             TreatUnmatchedTokensAsErrors = true
         };
-        root.Add(verboseOption);
-
-        root.Add(BuildScannerCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildScanCommand(services, options, verboseOption, cancellationToken));
-        root.Add(BuildDatabaseCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildSourcesCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildAocCommand(services, verboseOption, cancellationToken));
-        root.Add(BuildAuthCommand(services, options, verboseOption, cancellationToken));
+        root.Add(verboseOption);
+
+        root.Add(BuildScannerCommand(services, verboseOption, cancellationToken));
+        root.Add(BuildScanCommand(services, options, verboseOption, cancellationToken));
+        root.Add(BuildRubyCommand(services, verboseOption, cancellationToken));
+        root.Add(BuildDatabaseCommand(services, verboseOption, cancellationToken));
+        root.Add(BuildSourcesCommand(services, verboseOption, cancellationToken));
+        root.Add(BuildAocCommand(services, verboseOption, cancellationToken));
+        root.Add(BuildAuthCommand(services, options, verboseOption, cancellationToken));
         root.Add(BuildPolicyCommand(services, options, verboseOption, cancellationToken));
         root.Add(BuildTaskRunnerCommand(services, verboseOption, cancellationToken));
         root.Add(BuildFindingsCommand(services, verboseOption, cancellationToken));
@@ -177,14 +178,82 @@ internal static class CommandFactory
         scan.Add(entryTrace);
 
         scan.Add(run);
-        scan.Add(upload);
-        return scan;
-    }
-
+        scan.Add(upload);
+        return scan;
+    }
+
+    private static Command BuildRubyCommand(IServiceProvider services, Option<bool> verboseOption, CancellationToken cancellationToken)
+    {
+        var ruby = new Command("ruby", "Work with Ruby analyzer outputs.");
+
+        var inspect = new Command("inspect", "Inspect a local Ruby workspace.");
+        var inspectRootOption = new Option<string?>("--root")
+        {
+            Description = "Path to the Ruby workspace (defaults to current directory)."
+        };
+        var inspectFormatOption = new Option<string?>("--format")
+        {
+            Description = "Output format (table or json)."
+        };
+
+        inspect.Add(inspectRootOption);
+        inspect.Add(inspectFormatOption);
+        inspect.SetAction((parseResult, _) =>
+        {
+            var root = parseResult.GetValue(inspectRootOption);
+            var format = parseResult.GetValue(inspectFormatOption) ?? "table";
+            var verbose = parseResult.GetValue(verboseOption);
+
+            return CommandHandlers.HandleRubyInspectAsync(
+                services,
+                root,
+                format,
+                verbose,
+                cancellationToken);
+        });
+
+        var resolve = new Command("resolve", "Fetch Ruby packages for a completed scan.");
+        var resolveImageOption = new Option<string?>("--image")
+        {
+            Description = "Image reference (digest or tag) used by the scan."
+        };
+        var resolveScanIdOption = new Option<string?>("--scan-id")
+        {
+            Description = "Explicit scan identifier."
+        };
+        var resolveFormatOption = new Option<string?>("--format")
+        {
+            Description = "Output format (table or json)."
+        };
+
+        resolve.Add(resolveImageOption);
+        resolve.Add(resolveScanIdOption);
+        resolve.Add(resolveFormatOption);
+        resolve.SetAction((parseResult, _) =>
+        {
+            var image = parseResult.GetValue(resolveImageOption);
+            var scanId = parseResult.GetValue(resolveScanIdOption);
+            var format = parseResult.GetValue(resolveFormatOption) ?? "table";
+            var verbose = parseResult.GetValue(verboseOption);
+
+            return CommandHandlers.HandleRubyResolveAsync(
+                services,
+                image,
+                scanId,
+                format,
+                verbose,
+                cancellationToken);
+        });
+
+        ruby.Add(inspect);
+        ruby.Add(resolve);
+        return ruby;
+    }
+
     private static Command BuildKmsCommand(IServiceProvider services, Option<bool> verboseOption, CancellationToken cancellationToken)
     {
-        var kms = new Command("kms", "Manage file-backed signing keys.");
-
+        var kms = new Command("kms", "Manage file-backed signing keys.");
+
         var export = new Command("export", "Export key material to a portable bundle.");
         var exportRootOption = new Option<string>("--root")
         {