Add post-quantum cryptography support with PqSoftCryptoProvider

- Implemented PqSoftCryptoProvider for software-only post-quantum algorithms (Dilithium3, Falcon512) using BouncyCastle.
- Added PqSoftProviderOptions and PqSoftKeyOptions for configuration.
- Created unit tests for Dilithium3 and Falcon512 signing and verification.
- Introduced EcdsaPolicyCryptoProvider for compliance profiles (FIPS/eIDAS) with explicit allow-lists.
- Added KcmvpHashOnlyProvider for KCMVP baseline compliance.
- Updated project files and dependencies for new libraries and testing frameworks.

ops/devops/findings-ledger/offline-kit/scripts/import-images.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Import Findings Ledger container images into local Docker/containerd
+# Usage: ./import-images.sh [registry-prefix]
+#
+# Example:
+#   ./import-images.sh                    # Loads as stellaops/*
+#   ./import-images.sh myregistry.local/  # Loads and tags as myregistry.local/stellaops/*
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+IMAGES_DIR="${SCRIPT_DIR}/../images"
+REGISTRY_PREFIX="${1:-}"
+
+# Color output helpers
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $*"; }
+
+# Detect container runtime
+detect_runtime() {
+    if command -v docker &>/dev/null; then
+        echo "docker"
+    elif command -v nerdctl &>/dev/null; then
+        echo "nerdctl"
+    elif command -v podman &>/dev/null; then
+        echo "podman"
+    else
+        log_error "No container runtime found (docker, nerdctl, podman)"
+        exit 1
+    fi
+}
+
+RUNTIME=$(detect_runtime)
+log_info "Using container runtime: $RUNTIME"
+
+# Load images from tarballs
+load_images() {
+    local count=0
+
+    for tarball in "${IMAGES_DIR}"/*.tar; do
+        if [[ -f "$tarball" ]]; then
+            log_info "Loading image from: $(basename "$tarball")"
+
+            if $RUNTIME load -i "$tarball"; then
+                ((count++))
+            else
+                log_error "Failed to load: $tarball"
+                return 1
+            fi
+        fi
+    done
+
+    if [[ $count -eq 0 ]]; then
+        log_warn "No image tarballs found in $IMAGES_DIR"
+        log_warn "Run the offline kit builder first to populate images"
+        return 1
+    fi
+
+    log_info "Loaded $count image(s)"
+}
+
+# Re-tag images with custom registry prefix
+retag_images() {
+    if [[ -z "$REGISTRY_PREFIX" ]]; then
+        log_info "No registry prefix specified, skipping re-tag"
+        return 0
+    fi
+
+    local images=(
+        "stellaops/findings-ledger"
+        "stellaops/findings-ledger-migrations"
+    )
+
+    for image in "${images[@]}"; do
+        # Get the loaded tag
+        local loaded_tag
+        loaded_tag=$($RUNTIME images --format '{{.Repository}}:{{.Tag}}' | grep "^${image}:" | head -1)
+
+        if [[ -n "$loaded_tag" ]]; then
+            local new_tag="${REGISTRY_PREFIX}${loaded_tag}"
+            log_info "Re-tagging: $loaded_tag -> $new_tag"
+            $RUNTIME tag "$loaded_tag" "$new_tag"
+        fi
+    done
+}
+
+# Verify loaded images
+verify_images() {
+    log_info "Verifying loaded images..."
+
+    local images=(
+        "stellaops/findings-ledger"
+        "stellaops/findings-ledger-migrations"
+    )
+
+    local missing=0
+    for image in "${images[@]}"; do
+        if $RUNTIME images --format '{{.Repository}}' | grep -q "^${REGISTRY_PREFIX}${image}$"; then
+            log_info "  ✓ ${REGISTRY_PREFIX}${image}"
+        else
+            log_error "  ✗ ${REGISTRY_PREFIX}${image} not found"
+            ((missing++))
+        fi
+    done
+
+    if [[ $missing -gt 0 ]]; then
+        log_error "$missing image(s) missing"
+        return 1
+    fi
+
+    log_info "All images verified"
+}
+
+main() {
+    log_info "Findings Ledger - Image Import"
+    log_info "=============================="
+
+    load_images
+    retag_images
+    verify_images
+
+    log_info "Image import complete"
+}
+
+main "$@"

ops/devops/findings-ledger/offline-kit/scripts/run-migrations.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Run Findings Ledger database migrations
+# Usage: ./run-migrations.sh [connection-string]
+#
+# Environment variables:
+#   LEDGER__DB__CONNECTIONSTRING - PostgreSQL connection string (if not provided as arg)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MIGRATIONS_DIR="${SCRIPT_DIR}/../migrations"
+
+# Color output helpers
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $*"; }
+
+# Get connection string
+CONNECTION_STRING="${1:-${LEDGER__DB__CONNECTIONSTRING:-}}"
+
+if [[ -z "$CONNECTION_STRING" ]]; then
+    log_error "Connection string required"
+    echo "Usage: $0 <connection-string>"
+    echo "  or set LEDGER__DB__CONNECTIONSTRING environment variable"
+    exit 1
+fi
+
+# Detect container runtime
+detect_runtime() {
+    if command -v docker &>/dev/null; then
+        echo "docker"
+    elif command -v nerdctl &>/dev/null; then
+        echo "nerdctl"
+    elif command -v podman &>/dev/null; then
+        echo "podman"
+    else
+        log_error "No container runtime found"
+        exit 1
+    fi
+}
+
+RUNTIME=$(detect_runtime)
+
+# Run migrations via container
+run_migrations_container() {
+    log_info "Running migrations via container..."
+
+    $RUNTIME run --rm \
+        -e "LEDGER__DB__CONNECTIONSTRING=${CONNECTION_STRING}" \
+        --network host \
+        stellaops/findings-ledger-migrations:2025.11.0 \
+        --connection "$CONNECTION_STRING"
+}
+
+# Alternative: Run migrations via psql (if dotnet not available)
+run_migrations_psql() {
+    log_info "Running migrations via psql..."
+
+    if ! command -v psql &>/dev/null; then
+        log_error "psql not found and container runtime unavailable"
+        exit 1
+    fi
+
+    # Parse connection string for psql
+    # Expected format: Host=...;Port=...;Database=...;Username=...;Password=...
+    local host port database username password
+    host=$(echo "$CONNECTION_STRING" | grep -oP 'Host=\K[^;]+')
+    port=$(echo "$CONNECTION_STRING" | grep -oP 'Port=\K[^;]+' || echo "5432")
+    database=$(echo "$CONNECTION_STRING" | grep -oP 'Database=\K[^;]+')
+    username=$(echo "$CONNECTION_STRING" | grep -oP 'Username=\K[^;]+')
+    password=$(echo "$CONNECTION_STRING" | grep -oP 'Password=\K[^;]+')
+
+    export PGPASSWORD="$password"
+
+    for migration in "${MIGRATIONS_DIR}"/*.sql; do
+        if [[ -f "$migration" ]]; then
+            log_info "Applying: $(basename "$migration")"
+            psql -h "$host" -p "$port" -U "$username" -d "$database" -f "$migration"
+        fi
+    done
+
+    unset PGPASSWORD
+}
+
+verify_connection() {
+    log_info "Verifying database connection..."
+
+    # Try container-based verification
+    if $RUNTIME run --rm \
+        --network host \
+        postgres:14-alpine \
+        pg_isready -h "$(echo "$CONNECTION_STRING" | grep -oP 'Host=\K[^;]+')" \
+                   -p "$(echo "$CONNECTION_STRING" | grep -oP 'Port=\K[^;]+' || echo 5432)" \
+        &>/dev/null; then
+        log_info "Database connection verified"
+        return 0
+    fi
+
+    log_warn "Could not verify database connection (may still work)"
+    return 0
+}
+
+main() {
+    log_info "Findings Ledger - Database Migrations"
+    log_info "======================================"
+
+    verify_connection
+
+    # Prefer container-based migrations
+    if $RUNTIME image inspect stellaops/findings-ledger-migrations:2025.11.0 &>/dev/null; then
+        run_migrations_container
+    else
+        log_warn "Migration image not found, falling back to psql"
+        run_migrations_psql
+    fi
+
+    log_info "Migrations complete"
+}
+
+main "$@"

ops/devops/findings-ledger/offline-kit/scripts/verify-install.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Verify Findings Ledger installation
+# Usage: ./verify-install.sh [service-url]
+
+set -euo pipefail
+
+SERVICE_URL="${1:-http://localhost:8188}"
+
+# Color output helpers
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $*"; }
+log_pass() { echo -e "${GREEN}  ✓${NC} $*"; }
+log_fail() { echo -e "${RED}  ✗${NC} $*"; }
+
+CHECKS_PASSED=0
+CHECKS_FAILED=0
+
+run_check() {
+    local name="$1"
+    local cmd="$2"
+
+    if eval "$cmd" &>/dev/null; then
+        log_pass "$name"
+        ((CHECKS_PASSED++))
+    else
+        log_fail "$name"
+        ((CHECKS_FAILED++))
+    fi
+}
+
+main() {
+    log_info "Findings Ledger - Installation Verification"
+    log_info "==========================================="
+    log_info "Service URL: $SERVICE_URL"
+    echo ""
+
+    log_info "Health Checks:"
+    run_check "Readiness endpoint" "curl -sf ${SERVICE_URL}/health/ready"
+    run_check "Liveness endpoint" "curl -sf ${SERVICE_URL}/health/live"
+
+    echo ""
+    log_info "Metrics Checks:"
+    run_check "Metrics endpoint available" "curl -sf ${SERVICE_URL}/metrics | head -1"
+    run_check "ledger_write_latency_seconds present" "curl -sf ${SERVICE_URL}/metrics | grep -q ledger_write_latency_seconds"
+    run_check "ledger_projection_lag_seconds present" "curl -sf ${SERVICE_URL}/metrics | grep -q ledger_projection_lag_seconds"
+    run_check "ledger_merkle_anchor_duration_seconds present" "curl -sf ${SERVICE_URL}/metrics | grep -q ledger_merkle_anchor_duration_seconds"
+
+    echo ""
+    log_info "API Checks:"
+    run_check "OpenAPI spec available" "curl -sf ${SERVICE_URL}/swagger/v1/swagger.json | head -1"
+
+    echo ""
+    log_info "========================================"
+    log_info "Results: ${CHECKS_PASSED} passed, ${CHECKS_FAILED} failed"
+
+    if [[ $CHECKS_FAILED -gt 0 ]]; then
+        log_error "Some checks failed. Review service logs for details."
+        exit 1
+    fi
+
+    log_info "All checks passed. Installation verified."
+}
+
+main "$@"