feat(advisory-ai): Add deployment guide, Dockerfile, and Helm chart for on-prem packaging

- Introduced a comprehensive deployment guide for AdvisoryAI, detailing local builds, remote inference toggles, and scaling guidance.
- Created a multi-role Dockerfile for building WebService and Worker images.
- Added a docker-compose file for local and offline deployment.
- Implemented a Helm chart for Kubernetes deployment with persistence and remote inference options.
- Established a new API endpoint `/advisories/summary` for deterministic summaries of observations and linksets.
- Introduced a JSON schema for risk profiles and a validator to ensure compliance with the schema.
- Added unit tests for the risk profile validator to ensure functionality and error handling.

ops/advisory-ai/Dockerfile

@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1.7-labs
+
+# StellaOps AdvisoryAI – multi-role container build
+# Build arg PROJECT selects WebService or Worker; defaults to WebService.
+# Example builds:
+#   docker build -f ops/advisory-ai/Dockerfile -t stellaops-advisoryai-web \
+#     --build-arg PROJECT=src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/StellaOps.AdvisoryAI.WebService.csproj \
+#     --build-arg APP_DLL=StellaOps.AdvisoryAI.WebService.dll .
+#   docker build -f ops/advisory-ai/Dockerfile -t stellaops-advisoryai-worker \
+#     --build-arg PROJECT=src/AdvisoryAI/StellaOps.AdvisoryAI.Worker/StellaOps.AdvisoryAI.Worker.csproj \
+#     --build-arg APP_DLL=StellaOps.AdvisoryAI.Worker.dll .
+
+ARG SDK_IMAGE=mcr.microsoft.com/dotnet/nightly/sdk:10.0
+ARG RUNTIME_IMAGE=gcr.io/distroless/dotnet/aspnet:latest
+ARG PROJECT=src/AdvisoryAI/StellaOps.AdvisoryAI.WebService/StellaOps.AdvisoryAI.WebService.csproj
+ARG APP_DLL=StellaOps.AdvisoryAI.WebService.dll
+
+FROM ${SDK_IMAGE} AS build
+WORKDIR /src
+
+COPY . .
+
+# Restore only AdvisoryAI graph to keep build smaller.
+RUN dotnet restore ${PROJECT}
+
+RUN dotnet publish ${PROJECT} \
+    -c Release \
+    -o /app/publish \
+    /p:UseAppHost=false
+
+FROM ${RUNTIME_IMAGE} AS runtime
+WORKDIR /app
+
+ENV ASPNETCORE_URLS=http://0.0.0.0:8080 \
+    DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=true \
+    ADVISORYAI__STORAGE__PLANCACHEDIRECTORY=/app/data/plans \
+    ADVISORYAI__STORAGE__OUTPUTDIRECTORY=/app/data/outputs \
+    ADVISORYAI__QUEUE__DIRECTORYPATH=/app/data/queue \
+    ADVISORYAI__INFERENCE__MODE=Local
+
+COPY --from=build /app/publish ./
+
+# Writable mount for queue/cache/output. Guardrail/guardrails can also be mounted under /app/etc.
+VOLUME ["/app/data", "/app/etc"]
+
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "${APP_DLL}"]