Add new features and tests for AirGap and Time modules

- Introduced `SbomService` tasks documentation.
- Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`.
- Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace.
- Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories.
- Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests.
- Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace.
- Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.

docs/modules/sbomservice/offline-feed-plan.md

@@ -0,0 +1,27 @@
+# SBOM Service Offline Feed Plan (prep for PREP-SBOM-CONSOLE-23-001)
+
+## Problem
+SbomService builds/tests were failing restore due to missing NuGet packages (notably `Microsoft.IdentityModel.Tokens >= 8.14.0` and `Pkcs11Interop >= 4.1.0`). Offline/air-gap posture requires a cached feed.
+
+## What landed (2025-11-20)
+- Offline cache populated under `local-nugets/packages/` via `tools/offline/fetch-sbomservice-deps.sh`.
+- Key package hashes:
+  - `Microsoft.IdentityModel.Tokens.8.14.0.nupkg` · SHA256 `00b78c7b7023132e1d6b31d305e47524732dce6faca92dd16eb8d05a835bba7a`
+  - `Pkcs11Interop.4.1.0.nupkg` · SHA256 `8d2b323a3abb9de47a06a3c3b662aa526ee5c1637b70db072c66dc28e6f14c1e`
+- Script: `tools/offline/fetch-sbomservice-deps.sh` (idempotent) hydrates required packages into `local-nugets/packages` using a minimal probe project with `--ignore-failed-sources` to stay air-gap friendly.
+
+## How to use
+```bash
+# refresh cache if versions change
+./tools/offline/fetch-sbomservice-deps.sh
+
+# run SbomService tests offline
+DOTNET_NOLOGO=1 dotnet test src/SbomService/StellaOps.SbomService.Tests/StellaOps.SbomService.Tests.csproj --no-build --ignore-failed-sources
+```
+
+## Next actions
+- If additional packages surface during `dotnet restore`, append them to the probe project in the script and re-run.
+- Keep `local-nugets/` under version control for deterministic builds; update hashes when packages change.
+
+## Owners
+- SBOM Service Guild · Build/Infra (sprint 0142_0001_0001).

docs/modules/sbomservice/prep/2025-11-20-build-infra-prep.md

@@ -0,0 +1,15 @@
+# Build/Infra Prep — PREP-BUILD-INFRA-SBOM-SERVICE-GUILD-BLOCKED-M
+
+Status: Draft (2025-11-20)
+Owners: SBOM Service Guild
+Scope: Document restore/build blocking issues awaiting vetted feed/cache.
+
+## Blocker summary
+- Multiple restore attempts hang/fail; need vetted NuGet feed/cache for SBOM Service solution.
+
+## Needed actions
+- Provide approved offline feed snapshot for SBOM Service dependencies.
+- CI runner with feed configured to validate restore.
+
+## Handoff
+Use as PREP artefact; update once feed snapshot is supplied and restore passes.

docs/modules/sbomservice/prep/2025-11-20-sbom-service-21-001-prep.md

@@ -0,0 +1,20 @@
+# SBOM Service Prep — PREP-SBOM-SERVICE-21-001
+
+Status: Draft (2025-11-20)
+Owners: SBOM Service Guild · Cartographer Guild
+Scope: Waiting on LNM v1 fixtures to freeze normalized SBOM projection read API.
+
+## Needed inputs
+- LNM v1 fixtures (due 2025-11-18 UTC) for schema alignment.
+
+## Proposed API surface (draft)
+- `GET /sboms/{id}/projection` with query `page`, `page_size`, `tenant_id`.
+- Response includes `components[]`, `licenses[]`, `hashes[]`, `provenance`.
+- Deterministic ordering, tenant enforcement.
+
+## Open decisions
+- Pagination defaults and max page size.
+- Which hash algorithms to expose.
+
+## Handoff
+Use as PREP artefact; finalize once fixtures arrive.