Add Policy DSL Validator, Schema Exporter, and Simulation Smoke tools

- Implemented PolicyDslValidator with command-line options for strict mode and JSON output.
- Created PolicySchemaExporter to generate JSON schemas for policy-related models.
- Developed PolicySimulationSmoke tool to validate policy simulations against expected outcomes.
- Added project files and necessary dependencies for each tool.
- Ensured proper error handling and usage instructions across tools.

docs/ARCHITECTURE_DEVOPS.md

@@ -76,8 +76,14 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
 * **Unit/integration**: per‑component, plus **end‑to‑end** flows (scan→vex→policy→sign→attest).
 * **Perf SLOs**: hot paths (SBOM compose, diff, export) measured against budgets.
 * **Security**: dependency audit vs Concelier export; container hardening tests; minimal caps.
+* **Analyzer smoke**: restart-time language plug-ins (currently Python) verified via `dotnet run --project tools/LanguageAnalyzerSmoke` to ensure manifest integrity plus cold vs warm determinism (< 30 s / < 5 s budgets); the harness logs deviations from repository goldens for follow-up.
 * **Canary cohort**: internal staging + selected customers; one week on **edge** before **stable** tag.
 
+### 2.5 Debug-store artefacts
+
+* Every release exports stripped debug information for ELF binaries discovered in service images. Debug files follow the GNU build-id layout (`debug/.build-id/<aa>/<rest>.debug`) and are generated via `objcopy --only-keep-debug`.
+* `debug/debug-manifest.json` captures build-id → component/image/source mappings with SHA-256 checksums so operators can mirror the directory into debuginfod or offline symbol stores. The manifest (and its `.sha256` companion) ships with every release bundle and Offline Kit.
+
 ---
 
 ## 3) Distribution & activation
@@ -92,7 +98,7 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
 **Gating policy**:
 
 * **Core images** (Authority, Scanner, Concelier, Excititor, Attestor, UI): public **read**.
-* **Enterprise add‑ons** (if any) and **pre‑release**: private repos via OAuth2 token service.
+* **Enterprise add‑ons** (if any) and **pre‑release**: private repos via the **Registry Token Service** (`src/StellaOps.Registry.TokenService`) which exchanges Authority-issued OpToks for short-lived Docker registry bearer tokens.
 
 > Monetization lever is **signing** (PoE gate), not image pulls, so the core remains simple to consume.
 
@@ -105,6 +111,8 @@ At startup, services **self‑advertise** their semver & channel; the UI surface
   3. Registry allows pull for the requested repo.
 * Tokens are **short‑lived** (60–300 s) and **DPoP‑bound**.
 
+The token service enforces plan gating via `registry-token.yaml` (see `docs/ops/registry-token-service.md`) and exposes Prometheus metrics (`registry_token_issued_total`, `registry_token_rejected_total`). Revoked licence identifiers halt issuance even when scope requirements are met.
+
 ### 3.3 Offline kits (air‑gapped)
 
 * Tarball per release channel: