feat: Implement IsolatedReplayContext for deterministic audit replay

- Added IsolatedReplayContext class to provide an isolated environment for replaying audit bundles without external calls.
- Introduced methods for initializing the context, verifying input digests, and extracting inputs for policy evaluation.
- Created supporting interfaces and options for context configuration.

feat: Create ReplayExecutor for executing policy re-evaluation and verdict comparison

- Developed ReplayExecutor class to handle the execution of replay processes, including input verification and verdict comparison.
- Implemented detailed drift detection and error handling during replay execution.
- Added interfaces for policy evaluation and replay execution options.

feat: Add ScanSnapshotFetcher for fetching scan data and snapshots

- Introduced ScanSnapshotFetcher class to retrieve necessary scan data and snapshots for audit bundle creation.
- Implemented methods to fetch scan metadata, advisory feeds, policy snapshots, and VEX statements.
- Created supporting interfaces for scan data, feed snapshots, and policy snapshots.

docs/modules/cli/guides/cli-reference.md

@@ -36,7 +36,7 @@ stella sources ingest --dry-run \
 
 ### 2.2 Description
 
-Previews an ingestion write without touching MongoDB. The command loads an upstream advisory or VEX document, computes the would-write payload, runs it through the `AOCWriteGuard`, and reports any forbidden fields, provenance gaps, or idempotency issues. Use it during connector development, CI validation, or while triaging incidents.
+Previews an ingestion write without touching the database. The command loads an upstream advisory or VEX document, computes the would-write payload, runs it through the `AOCWriteGuard`, and reports any forbidden fields, provenance gaps, or idempotency issues. Use it during connector development, CI validation, or while triaging incidents.
 
 ### 2.3 Options
 
@@ -370,7 +370,7 @@ sha256sum /mnt/offline/aoc-verify-*.json > /mnt/offline/checksums.txt
 
 ### 3.8 Offline notes
 
-- Works against Offline Kit Mongo snapshots when CLI is pointed at the local API gateway included in the bundle.
+- Works against Offline Kit PostgreSQL snapshots when CLI is pointed at the local API gateway included in the bundle.
 - When fully disconnected, run against exported `aoc verify` reports generated on production and replay them using `--format json --export` (automation recipe above).
 - Include verification output in compliance packages alongside Offline Kit manifests.