Add Policy DSL Validator, Schema Exporter, and Simulation Smoke tools

- Implemented PolicyDslValidator with command-line options for strict mode and JSON output.
- Created PolicySchemaExporter to generate JSON schemas for policy-related models.
- Developed PolicySimulationSmoke tool to validate policy simulations against expected outcomes.
- Added project files and necessary dependencies for each tool.
- Ensured proper error handling and usage instructions across tools.

docs/09_API_CLI_REFERENCE.md

@@ -629,6 +629,32 @@ See `docs/dev/32_AUTH_CLIENT_GUIDE.md` for recommended profiles (online vs. air-
 | `stellaops-cli config show` | Display resolved configuration | — | Masks secret values; helpful for air‑gapped installs |
 | `stellaops-cli runtime policy test` | Ask Scanner.WebService for runtime verdicts (Webhook parity) | `--image/-i <digest>` (repeatable, comma/space lists supported)<br>`--file/-f <path>`<br>`--namespace/--ns <name>`<br>`--label/-l key=value` (repeatable)<br>`--json` | Posts to `POST /api/v1/scanner/policy/runtime`, deduplicates image digests, and prints TTL/policy revision plus per-image columns for signed state, SBOM referrers, quieted-by metadata, confidence, Rekor attestation (uuid + verified flag), and recently observed build IDs (shortened for readability). Accepts newline/whitespace-delimited stdin when piped; `--json` emits the raw response without additional logging. |
 
+#### Example: Pivot from runtime verdicts to debug symbols
+
+```bash
+$ stellaops-cli runtime policy test \
+    --image ghcr.io/acme/payments@sha256:4f7d55f6... \
+    --namespace payments
+
+Image Digest                                         Signed  SBOM    Build IDs                            TTL
+ghcr.io/acme/payments@sha256:4f7d55f6...             yes     present 5f0c7c3c..., 1122aabbccddeeff...     04:59:55
+```
+
+1. Copy one of the hashes (e.g. `5f0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789`) and locate the bundled debug artefact:
+   ```bash
+   ls offline-kit/debug/.build-id/5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug
+   ```
+2. Confirm the running binary advertises the same GNU build-id:
+   ```bash
+   readelf -n /proc/$(pgrep -f payments-api | head -n1)/exe | grep -i 'Build ID'
+   ```
+3. If you operate a debuginfod mirror backed by the Offline Kit tree, resolve symbols with:
+   ```bash
+   debuginfod-find debuginfo 5f0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789 >/tmp/payments-api.debug
+   ```
+
+See [Offline Kit step 0](24_OFFLINE_KIT.md#0-prepare-the-debug-store) for instructions on mirroring the debug store before packaging.
+
 `POST /api/v1/scanner/policy/runtime` responds with one entry per digest. Each result now includes:
 
 - `policyVerdict` (`pass|warn|fail|error`), `signed`, and `hasSbomReferrers` parity with the webhook contract.
@@ -739,7 +765,7 @@ For offline workflows, configure `StellaOps:Offline:KitsDirectory` (or `STELLAOP
       "ClientSecret": "REDACTED",
       "Username": "",
       "Password": "",
-      "Scope": "concelier.jobs.trigger",
+      "Scope": "concelier.jobs.trigger advisory:ingest advisory:read",
       "TokenCacheDirectory": ""
     }
   }