Add Policy DSL Validator, Schema Exporter, and Simulation Smoke tools

- Implemented PolicyDslValidator with command-line options for strict mode and JSON output.
- Created PolicySchemaExporter to generate JSON schemas for policy-related models.
- Developed PolicySimulationSmoke tool to validate policy simulations against expected outcomes.
- Added project files and necessary dependencies for each tool.
- Ensured proper error handling and usage instructions across tools.

docs/ops/zastava-runtime-operations.md

@@ -137,19 +137,33 @@ Runtime events emitted by Observer now include `process.buildId` (from the ELF
 `buildIds` list per digest. Operators can use these hashes to locate debug
 artifacts during incident response:
 
-1. Capture the hash from CLI/webhook/Scanner API (example:
+1. Capture the hash from CLI/webhook/Scanner API—for example:
+   ```bash
+   stellaops-cli runtime policy test --image <digest> --namespace <ns>
+   ```
+   Copy one of the `Build IDs` (e.g.
    `5f0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789`).
-2. Derive the path: `<hash[0:2]>/<hash[2:]>` under the debug store, e.g.
-   `/var/opt/debug/.build-id/5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug`.
+2. Derive the debug path (`<aa>/<rest>` under `.build-id`) and check it exists:
+   ```bash
+   ls /var/opt/debug/.build-id/5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug
+   ```
 3. If the file is missing, rehydrate it from Offline Kit bundles or the
-   `debug-store` object bucket (mirror of release artefacts). Use:
-   ```sh
+   `debug-store` object bucket (mirror of release artefacts):
+   ```bash
    oras cp oci://registry.internal/debug-store:latest . --include \
      "5f/0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789.debug"
    ```
-4. Attach the `.debug` file in `gdb`/`lldb` or feed it to `eu-unstrip` when
-   preparing symbolized traces.
-5. For musl-based images, expect shorter build-id footprints. Missing hashes in
+4. Confirm the running process advertises the same GNU build-id before
+   symbolising:
+   ```bash
+   readelf -n /proc/$(pgrep -f payments-api | head -n1)/exe | grep -i 'Build ID'
+   ```
+5. Attach the `.debug` file in `gdb`/`lldb`, feed it to `eu-unstrip`, or cache it
+   in `debuginfod` for fleet-wide symbol resolution:
+   ```bash
+   debuginfod-find debuginfo 5f0c7c3cb4d9f8a4f1c1d5c6b7e8f90123456789 >/tmp/payments-api.debug
+   ```
+6. For musl-based images, expect shorter build-id footprints. Missing hashes in
    runtime events indicate stripped binaries without the GNU note—schedule a
    rebuild with `-Wl,--build-id` enabled or add the binary to the debug-store
    allowlist so the scanner can surface a fallback symbol package.