Add new features and tests for AirGap and Time modules

- Introduced `SbomService` tasks documentation.
- Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`.
- Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace.
- Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories.
- Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests.
- Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace.
- Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.

docs/modules/policy/prep/2025-11-20-riskprofile-66-001-prep.md

@@ -0,0 +1,16 @@
+# Risk Profile Library Prep — PREP-POLICY-RISK-66-001
+
+Status: Draft (2025-11-20)
+Owners: Risk Profile Schema Guild
+Scope: Scaffold requirements for `StellaOps.Policy.RiskProfile` project and storage contract.
+
+## Needs
+- Project skeleton (net10.0) under `src/Policy/StellaOps.Policy.RiskProfile` with schema/validators.
+- Storage contract: collections/fields for risk profiles; deterministic hashing rules.
+
+## Open decisions
+- Exact schema fields and validation rules.
+- Versioning strategy (semver vs commit hash) for profiles.
+
+## Handoff
+Use as PREP artefact; update once schema fields and storage strategy are agreed.