Add signal contracts for reachability, exploitability, trust, and unknown symbols

- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties.
- Implemented JSON serialization attributes for proper data interchange.
- Created project files for the new signal contracts library and corresponding test projects.
- Added deterministic test fixtures for micro-interaction testing.
- Included cryptographic keys for secure operations with cosign.

src/Policy/StellaOps.Policy.Engine/Options/PolicyEngineRateLimitOptions.cs

@@ -0,0 +1,48 @@
+namespace StellaOps.Policy.Engine.Options;
+
+/// <summary>
+/// Rate limiting configuration for Policy Engine simulation endpoints.
+/// </summary>
+public sealed class PolicyEngineRateLimitOptions
+{
+    /// <summary>
+    /// Configuration section name for binding.
+    /// </summary>
+    public const string SectionName = "RateLimiting";
+
+    /// <summary>
+    /// Maximum number of permits per window for simulation endpoints.
+    /// Default: 100 requests per window.
+    /// </summary>
+    public int SimulationPermitLimit { get; set; } = 100;
+
+    /// <summary>
+    /// Window duration in seconds for rate limiting.
+    /// Default: 60 seconds.
+    /// </summary>
+    public int WindowSeconds { get; set; } = 60;
+
+    /// <summary>
+    /// Maximum number of requests that can be queued when the limit is reached.
+    /// Default: 10 requests.
+    /// </summary>
+    public int QueueLimit { get; set; } = 10;
+
+    /// <summary>
+    /// Whether to partition rate limits by tenant ID.
+    /// When enabled, each tenant gets their own rate limit bucket.
+    /// Default: true.
+    /// </summary>
+    public bool TenantPartitioning { get; set; } = true;
+
+    /// <summary>
+    /// Whether rate limiting is enabled.
+    /// Default: true.
+    /// </summary>
+    public bool Enabled { get; set; } = true;
+
+    /// <summary>
+    /// Custom policy name for the simulation rate limiter.
+    /// </summary>
+    public const string PolicyName = "policy-simulation";
+}