Add unit tests and implementations for MongoDB index models and OpenAPI metadata

- Implemented `MongoIndexModelTests` to verify index models for various stores.
- Created `OpenApiMetadataFactory` with methods to generate OpenAPI metadata.
- Added tests for `OpenApiMetadataFactory` to ensure expected defaults and URL overrides.
- Introduced `ObserverSurfaceSecrets` and `WebhookSurfaceSecrets` for managing secrets.
- Developed `RuntimeSurfaceFsClient` and `WebhookSurfaceFsClient` for manifest retrieval.
- Added dependency injection tests for `SurfaceEnvironmentRegistration` in both Observer and Webhook contexts.
- Implemented tests for secret resolution in `ObserverSurfaceSecretsTests` and `WebhookSurfaceSecretsTests`.
- Created `EnsureLinkNotMergeCollectionsMigrationTests` to validate MongoDB migration logic.
- Added project files for MongoDB tests and NuGet package mirroring.

docs/modules/cli/guides/cli-reference.md

@@ -519,3 +519,27 @@ The Attestor response prints verification status, Rekor UUID (when available), a
 ---
 
 *Last updated: 2025-11-05 (Sprint 101).*
+
+## 3 · `stella scan entrytrace --stream-ndjson`
+
+### 3.1 Synopsis
+```bash
+stella scan entrytrace \
+  --scan-id <scanId> \
+  [--stream-ndjson] \
+  [--include-ndjson] \
+  [--verbose]
+```
+
+### 3.2 Description
+Streams the EntryTrace NDJSON produced by a completed scan. When `--stream-ndjson` is set the CLI sends `Accept: application/x-ndjson` and writes the raw lines to stdout in order, suitable for piping into AOC/ETL tools. Without the flag, the command returns the JSON envelope (`scanId`, `imageDigest`, graph, NDJSON array) and optionally prints NDJSON when `--include-ndjson` is set.
+
+### 3.3 Examples
+- Stream raw NDJSON for further processing:
+  ```bash
+  stella scan entrytrace --scan-id scan-123 --stream-ndjson > entrytrace.ndjson
+  ```
+- Retrieve JSON envelope (default behaviour):
+  ```bash
+  stella scan entrytrace --scan-id scan-123
+  ```