Add signal contracts for reachability, exploitability, trust, and unknown symbols

- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.

docs/modules/graph/contracts/examples/graph.inspect.v1.sample.json

@@ -77,6 +77,20 @@
         "linksetDigest": "abcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcd",
         "evidenceHash": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd"
       }
+    },
+    {
+      "purl": "pkg:npm/lodash@4.17.21",
+      "scopes": [],
+      "relationships": [],
+      "advisories": [],
+      "vexStatements": [],
+      "provenance": {
+        "source": "concelier.linkset.v1",
+        "collectedAt": "2025-12-04T15:29:00Z",
+        "eventOffset": 6000,
+        "linksetDigest": "abcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcdefabcd",
+        "evidenceHash": "89abcdef0123456789abcdef0123456789abcdef0123456789abcdef012345"
+      }
     }
   ],
   "links": {