feat: Add Scanner CI runner and related artifacts

- Implemented `run-scanner-ci.sh` to build and run tests for the Scanner solution with a warmed NuGet cache.
- Created `excititor-vex-traces.json` dashboard for monitoring Excititor VEX observations.
- Added Docker Compose configuration for the OTLP span sink in `docker-compose.spansink.yml`.
- Configured OpenTelemetry collector in `otel-spansink.yaml` to receive and process traces.
- Developed `run-spansink.sh` script to run the OTLP span sink for Excititor traces.
- Introduced `FileSystemRiskBundleObjectStore` for storing risk bundle artifacts in the filesystem.
- Built `RiskBundleBuilder` for creating risk bundles with associated metadata and providers.
- Established `RiskBundleJob` to execute the risk bundle creation and storage process.
- Defined models for risk bundle inputs, entries, and manifests in `RiskBundleModels.cs`.
- Implemented signing functionality for risk bundle manifests with `HmacRiskBundleManifestSigner`.
- Created unit tests for `RiskBundleBuilder`, `RiskBundleJob`, and signing functionality to ensure correctness.
- Added filesystem artifact reader tests to validate manifest parsing and artifact listing.
- Included test manifests for egress scenarios in the task runner tests.
- Developed timeline query service tests to verify tenant and event ID handling.

ops/devops/signals/README.md

@@ -5,6 +5,8 @@ Artifacts:
 - Sample config: `ops/devops/signals/signals.yaml` (mounted into the container at `/app/signals.yaml` if desired).
 - Dockerfile: `ops/devops/signals/Dockerfile` (multi-stage build on .NET 10 RC).
 - Build/export helper: `scripts/signals/build.sh` (saves image tar to `out/signals/signals-image.tar`).
+- Span sink stack: `ops/devops/signals/docker-compose.spansink.yml` + `otel-spansink.yaml` to collect OTLP traces (Excititor `/v1/vex/observations/**`) and write NDJSON to `spansink-data` volume. Run via `scripts/signals/run-spansink.sh`.
+- Grafana dashboard stub: `ops/devops/signals/dashboards/excititor-vex-traces.json` (import into Tempo-enabled Grafana).
 
 Quick start (offline-friendly):
 ```bash
@@ -16,6 +18,9 @@ COMPOSE_FILE=ops/devops/signals/docker-compose.signals.yml docker compose up -d
 
 # hit health
 curl -s http://localhost:5088/health
+
+# run span sink collector
+scripts/signals/run-spansink.sh
 ```
 
 Configuration (ENV or YAML):

ops/devops/signals/dashboards/excititor-vex-traces.json

@@ -0,0 +1,50 @@
+{
+  "title": "Excititor VEX Observations Traces",
+  "tags": ["excititor", "traces", "vex"],
+  "timezone": "browser",
+  "schemaVersion": 38,
+  "version": 1,
+  "refresh": "30s",
+  "panels": [
+    {
+      "type": "stat",
+      "title": "Spans (last 15m)",
+      "gridPos": {"h": 4, "w": 6, "x": 0, "y": 0},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "expr": "sum by(service_name)(rate(traces_spanmetrics_calls_total{service_name=~\"excititor.*\"}[15m]))"
+        }
+      ]
+    },
+    {
+      "type": "stat",
+      "title": "Errors (last 15m)",
+      "gridPos": {"h": 4, "w": 6, "x": 6, "y": 0},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "expr": "sum by(status_code)(rate(traces_spanmetrics_calls_total{status_code=\"STATUS_CODE_ERROR\",service_name=~\"excititor.*\"}[15m]))"
+        }
+      ]
+    },
+    {
+      "type": "table",
+      "title": "Recent /v1/vex/observations spans",
+      "gridPos": {"h": 12, "w": 24, "x": 0, "y": 4},
+      "options": {
+        "showHeader": true
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "queryType": "traceql",
+          "expr": "{ service.name = \"excititor\" && http.target = \"/v1/vex/observations\" } | limit 50"
+        }
+      ]
+    }
+  ]
+}

ops/devops/signals/docker-compose.spansink.yml

@@ -0,0 +1,17 @@
+version: '3.8'
+services:
+  otel-spansink:
+    image: otel/opentelemetry-collector-contrib:0.97.0
+    command: ["--config=/etc/otel/otel-spansink.yaml"]
+    volumes:
+      - ./otel-spansink.yaml:/etc/otel/otel-spansink.yaml:ro
+      - spansink-data:/var/otel
+    ports:
+      - "4317:4317"  # OTLP gRPC
+      - "4318:4318"  # OTLP HTTP
+    environment:
+      - OTEL_RESOURCE_ATTRIBUTES=service.name=excititor,telemetry.distro=stellaops
+    restart: unless-stopped
+volumes:
+  spansink-data:
+    driver: local

ops/devops/signals/otel-spansink.yaml

@@ -0,0 +1,31 @@
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+processors:
+  batch:
+    timeout: 1s
+    send_batch_size: 512
+
+exporters:
+  file/traces:
+    path: /var/otel/traces.ndjson
+    rotation:
+      max_megabytes: 100
+      max_backups: 5
+      max_days: 7
+      localtime: true
+
+service:
+  telemetry:
+    logs:
+      level: info
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [file/traces]