feat: Implement NotifyPanelComponent with unit tests and mock API service

- Added NotifyPanelComponent for managing notification channels and rules.
- Implemented reactive forms for channel and rule management.
- Created unit tests for NotifyPanelComponent to validate functionality.
- Developed MockNotifyApiService to simulate API interactions for testing.
- Added mock data for channels, rules, and deliveries to facilitate testing.
- Introduced RuntimeEventFactoryTests to ensure correct event creation with build ID.

docs/ops/nuget-preview-bootstrap.md

@@ -0,0 +1,49 @@
+# NuGet Preview Bootstrap (Offline-Friendly)
+
+The StellaOps build relies on .NET 10 preview packages (Microsoft.Extensions.*, JwtBearer 10.0 RC).
+`NuGet.config` now wires three sources:
+
+1. `local` → `./local-nuget` (preferred, air-gapped mirror)
+2. `dotnet-public` → `https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json`
+3. `nuget.org` → fallback for everything else
+
+Follow the steps below whenever you refresh the repo or roll a new Offline Kit drop.
+
+## 1. Mirror the preview packages
+
+```bash
+./ops/devops/sync-preview-nuget.sh
+```
+
+* Reads `ops/devops/nuget-preview-packages.csv`. Each line specifies the package, version, expected SHA-256 hash, and (optionally) the flat-container base URL (we pin to `dotnet-public`).
+* Downloads the `.nupkg` straight into `./local-nuget/` and re-verifies the checksum. Existing files are skipped when hashes already match.
+* Use `NUGET_V2_BASE` if you need to temporarily point at a different mirror.
+
+💡 The script never mutates packages in place—if a checksum changes you will see a “SHA mismatch … refreshing” message.
+
+## 2. Restore using the shared `NuGet.config`
+
+From the repo root:
+
+```bash
+DOTNET_NOLOGO=1 dotnet restore src/StellaOps.Excititor.Connectors.Abstractions/StellaOps.Excititor.Connectors.Abstractions.csproj \
+  --configfile NuGet.config
+```
+
+The `packageSourceMapping` section keeps `Microsoft.Extensions.*`, `Microsoft.AspNetCore.*`, and `Microsoft.Data.Sqlite` bound to `local`/`dotnet-public`, so `dotnet restore` never has to reach out to nuget.org when mirrors are populated.
+
+If you run fully air-gapped, remember to clear the cache between SDK upgrades:
+
+```bash
+dotnet nuget locals all --clear
+```
+
+## 3. Troubleshooting
+
+| Symptom | Fix |
+| --- | --- |
+| `dotnet restore` still hits nuget.org for preview packages | Re-run `sync-preview-nuget.sh` to ensure the `.nupkg` exists locally, then delete `~/.nuget/packages/microsoft.extensions.*` so the resolver picks up the mirrored copy. |
+| SHA mismatch in the manifest | Update `ops/devops/nuget-preview-packages.csv` with the new version + checksum (from the feed) and re-run the sync script. |
+| Azure DevOps feed throttling | Set `DOTNET_PUBLIC_FLAT_BASE` env var and point it at your own mirrored flat-container, then add the URL to the 4th column of the manifest. |
+
+Keep this doc alongside Offline Kit instructions so air-gapped operators know exactly how to refresh the mirror and verify packages before restore.

docs/ops/zastava-runtime-operations.md

@@ -129,3 +129,32 @@ It aligns with `Sprint 12 – Runtime Guardrails` and assumes components consume
 - Grafana dashboard JSON: `docs/ops/zastava-runtime-grafana-dashboard.json`.
 - Add both to the monitoring repo (`ops/monitoring/zastava`) and reference them in
   the Offline Kit manifest.
+
+## 7. Build-id correlation & symbol retrieval
+
+Runtime events emitted by Observer now include `process.buildId` (from the ELF
+`NT_GNU_BUILD_ID` note) and Scanner `/policy/runtime` surfaces the most recent
+`buildIds` list per digest. Operators can use these hashes to locate debug
+artifacts during incident response:
+
+1. Capture the hash from CLI/webhook/Scanner API (example:
+   `5f0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789`).
+2. Derive the path: `<hash[0:2]>/<hash[2:]>` under the debug store, e.g.
+   `/var/opt/debug/.build-id/5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug`.
+3. If the file is missing, rehydrate it from Offline Kit bundles or the
+   `debug-store` object bucket (mirror of release artefacts). Use:
+   ```sh
+   oras cp oci://registry.internal/debug-store:latest . --include \
+     "5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug"
+   ```
+4. Attach the `.debug` file in `gdb`/`lldb` or feed it to `eu-unstrip` when
+   preparing symbolized traces.
+5. For musl-based images, expect shorter build-id footprints. Missing hashes in
+   runtime events indicate stripped binaries without the GNU note—schedule a
+   rebuild with `-Wl,--build-id` enabled or add the binary to the debug-store
+   allowlist so the scanner can surface a fallback symbol package.
+
+Monitor `scanner.policy.runtime` responses for the `buildIds` field; absence of
+data after ZASTAVA-OBS-17-005 implies containers launched before the Observer
+upgrade or non-ELF entrypoints (static scripts). Re-run the workload or restart
+Observer to trigger a fresh capture if symbol parity is required.