finish secrets finding work and audit remarks work save

src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env/SurfaceEnvironmentBuilder.cs

@@ -18,18 +18,21 @@ public sealed class SurfaceEnvironmentBuilder
     private readonly IConfiguration _configuration;
     private readonly ILogger<SurfaceEnvironmentBuilder> _logger;
     private readonly SurfaceEnvironmentOptions _options;
+    private readonly TimeProvider _timeProvider;
     private readonly Dictionary<string, string> _raw = new(StringComparer.OrdinalIgnoreCase);
 
     public SurfaceEnvironmentBuilder(
         IServiceProvider services,
         IConfiguration configuration,
         ILogger<SurfaceEnvironmentBuilder> logger,
-        SurfaceEnvironmentOptions options)
+        SurfaceEnvironmentOptions options,
+        TimeProvider? timeProvider = null)
     {
         _services = services ?? throw new ArgumentNullException(nameof(services));
         _configuration = configuration ?? throw new ArgumentNullException(nameof(configuration));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         _options = options ?? throw new ArgumentNullException(nameof(options));
+        _timeProvider = timeProvider ?? TimeProvider.System;
 
         if (_options.Prefixes.Count == 0)
         {
@@ -60,9 +63,12 @@ public sealed class SurfaceEnvironmentBuilder
             featureFlags,
             secrets,
             tenant,
-            tls);
+            tls)
+        {
+            CreatedAtUtc = _timeProvider.GetUtcNow()
+        };
 
-        return settings with { CreatedAtUtc = DateTimeOffset.UtcNow };
+        return settings;
     }
 
     public IReadOnlyDictionary<string, string> GetRawVariables()

src/Scanner/__Libraries/StellaOps.Scanner.Surface.Env/SurfaceEnvironmentSettings.cs

@@ -21,5 +21,5 @@ public sealed record SurfaceEnvironmentSettings(
     /// <summary>
     /// Gets the timestamp (UTC) when the configuration snapshot was created.
     /// </summary>
-    public DateTimeOffset CreatedAtUtc { get; init; } = DateTimeOffset.UtcNow;
+    public required DateTimeOffset CreatedAtUtc { get; init; }
 }