feat: Add Scanner CI runner and related artifacts

- Implemented `run-scanner-ci.sh` to build and run tests for the Scanner solution with a warmed NuGet cache.
- Created `excititor-vex-traces.json` dashboard for monitoring Excititor VEX observations.
- Added Docker Compose configuration for the OTLP span sink in `docker-compose.spansink.yml`.
- Configured OpenTelemetry collector in `otel-spansink.yaml` to receive and process traces.
- Developed `run-spansink.sh` script to run the OTLP span sink for Excititor traces.
- Introduced `FileSystemRiskBundleObjectStore` for storing risk bundle artifacts in the filesystem.
- Built `RiskBundleBuilder` for creating risk bundles with associated metadata and providers.
- Established `RiskBundleJob` to execute the risk bundle creation and storage process.
- Defined models for risk bundle inputs, entries, and manifests in `RiskBundleModels.cs`.
- Implemented signing functionality for risk bundle manifests with `HmacRiskBundleManifestSigner`.
- Created unit tests for `RiskBundleBuilder`, `RiskBundleJob`, and signing functionality to ensure correctness.
- Added filesystem artifact reader tests to validate manifest parsing and artifact listing.
- Included test manifests for egress scenarios in the task runner tests.
- Developed timeline query service tests to verify tenant and event ID handling.

ops/devops/scanner-ci-runner/README.md

@@ -0,0 +1,25 @@
+# Scanner CI Runner Harness (DEVOPS-SCANNER-CI-11-001)
+
+Purpose: deterministic, offline-friendly harness that restores, builds, and exercises the Scanner analyzers + WebService/Worker tests with warmed NuGet cache and TRX/binlog outputs.
+
+Usage
+- From repo root run: `ops/devops/scanner-ci-runner/run-scanner-ci.sh`
+- Outputs land in `ops/devops/artifacts/scanner-ci/<UTC timestamp>/`:
+  - `build.binlog` (solution build)
+  - `tests/*.trx` for grouped test runs
+  - `summary.json` listing artefact paths and SHA256s
+
+Environment
+- Defaults: `DOTNET_CLI_TELEMETRY_OPTOUT=1`, `DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1`, `NUGET_PACKAGES=$REPO/.nuget/packages`.
+- Sources: `NUGET_SOURCES` (semicolon-separated) defaults to `local-nugets` then warmed cache; no internet required when cache is primed.
+- `TEST_FILTER` can narrow tests (empty = all).
+
+What it does
+1) Warm NuGet cache from `local-nugets/` into `$NUGET_PACKAGES`.
+2) `dotnet restore` + `dotnet build` on `src/Scanner/StellaOps.Scanner.sln` with `/bl`.
+3) Run Scanner test buckets (core/analyzers/web/worker) with TRX outputs; buckets can be adjusted via `TEST_FILTER` or script edits.
+4) Emit `summary.json` with artefact paths/hashes for reproducibility.
+
+Notes
+- Buckets are ordered to keep runtime predictable; adjust filters to target a subset when iterating.
+- Timestamped output directories keep ordering deterministic in offline pipelines.

ops/devops/scanner-ci-runner/run-scanner-ci.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Scanner CI runner harness (DEVOPS-SCANNER-CI-11-001)
+# Builds Scanner solution and runs grouped test buckets with warmed NuGet cache.
+
+repo_root="$(cd "$(dirname "$0")/../../.." && pwd)"
+ts="$(date -u +%Y%m%dT%H%M%SZ)"
+out_dir="$repo_root/ops/devops/artifacts/scanner-ci/$ts"
+logs_dir="$out_dir/tests"
+mkdir -p "$logs_dir"
+
+export DOTNET_CLI_TELEMETRY_OPTOUT=${DOTNET_CLI_TELEMETRY_OPTOUT:-1}
+export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=${DOTNET_SKIP_FIRST_TIME_EXPERIENCE:-1}
+export NUGET_PACKAGES=${NUGET_PACKAGES:-$repo_root/.nuget/packages}
+export NUGET_SOURCES=${NUGET_SOURCES:-"$repo_root/local-nugets;$repo_root/.nuget/packages"}
+export TEST_FILTER=${TEST_FILTER:-""}
+export DOTNET_RESTORE_DISABLE_PARALLEL=${DOTNET_RESTORE_DISABLE_PARALLEL:-1}
+
+mkdir -p "$NUGET_PACKAGES"
+rsync -a "$repo_root/local-nugets/" "$NUGET_PACKAGES/" >/dev/null 2>&1 || true
+
+restore_sources=()
+IFS=';' read -ra SRC_ARR <<< "$NUGET_SOURCES"
+for s in "${SRC_ARR[@]}"; do
+  [[ -n "$s" ]] && restore_sources+=(--source "$s")
+done
+
+solution="$repo_root/src/Scanner/StellaOps.Scanner.sln"
+dotnet restore "$solution" --ignore-failed-sources "${restore_sources[@]}"
+
+build_binlog="$out_dir/build.binlog"
+dotnet build "$solution" -c Release /p:ContinuousIntegrationBuild=true /bl:"$build_binlog"
+
+common_test_args=( -c Release --no-build --results-directory "$logs_dir" )
+if [[ -n "$TEST_FILTER" ]]; then
+  common_test_args+=( --filter "$TEST_FILTER" )
+fi
+
+run_tests() {
+  local project="$1" name="$2"
+  dotnet test "$project" "${common_test_args[@]}" --logger "trx;LogFileName=${name}.trx"
+}
+
+run_tests "$repo_root/src/Scanner/__Tests/StellaOps.Scanner.Core.Tests/StellaOps.Scanner.Core.Tests.csproj" core
+run_tests "$repo_root/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Tests/StellaOps.Scanner.Analyzers.OS.Tests.csproj" analyzers-os
+run_tests "$repo_root/src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Tests/StellaOps.Scanner.Analyzers.Lang.Tests.csproj" analyzers-lang
+run_tests "$repo_root/src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/StellaOps.Scanner.WebService.Tests.csproj" web
+run_tests "$repo_root/src/Scanner/__Tests/StellaOps.Scanner.Worker.Tests/StellaOps.Scanner.Worker.Tests.csproj" worker
+
+summary="$out_dir/summary.json"
+{
+  printf '{
+'
+  printf '  "timestamp_utc": "%s",
+' "$ts"
+  printf '  "build_binlog": "%s",
+' "${build_binlog#${repo_root}/}"
+  printf '  "tests": [
+'
+  printf '    {"name":"core","trx":"%s"},
+' "${logs_dir#${repo_root}/}/core.trx"
+  printf '    {"name":"analyzers-os","trx":"%s"},
+' "${logs_dir#${repo_root}/}/analyzers-os.trx"
+  printf '    {"name":"analyzers-lang","trx":"%s"},
+' "${logs_dir#${repo_root}/}/analyzers-lang.trx"
+  printf '    {"name":"web","trx":"%s"},
+' "${logs_dir#${repo_root}/}/web.trx"
+  printf '    {"name":"worker","trx":"%s"}
+' "${logs_dir#${repo_root}/}/worker.trx"
+  printf '  ],
+'
+  printf '  "nuget_packages": "%s",
+' "${NUGET_PACKAGES#${repo_root}/}"
+  printf '  "sources": [
+'
+  for i in "${!SRC_ARR[@]}"; do
+    sep=","; [[ $i -eq $((${#SRC_ARR[@]}-1)) ]] && sep=""
+    printf '    "%s"%s
+' "${SRC_ARR[$i]}" "$sep"
+  done
+  printf '  ]
+'
+  printf '}
+'
+} > "$summary"
+
+echo "Artifacts written to ${out_dir#${repo_root}/}"