Add signal contracts for reachability, exploitability, trust, and unknown symbols

- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.

etc/policy-engine.yaml.sample

@@ -36,3 +36,11 @@ resourceServer:
   bypassNetworks:
     - "127.0.0.1/32"
     - "::1/128"
+
+# Rate limiting for simulation endpoints (WEB-POLICY-20-004)
+rateLimiting:
+  enabled: true
+  simulationPermitLimit: 100    # Maximum requests per window
+  windowSeconds: 60             # Window duration in seconds
+  queueLimit: 10                # Requests queued when limit reached
+  tenantPartitioning: true      # Enable per-tenant rate limits