Implement MongoDB-based storage for Pack Run approval, artifact, log, and state management

- Added MongoPackRunApprovalStore for managing approval states with MongoDB.
- Introduced MongoPackRunArtifactUploader for uploading and storing artifacts.
- Created MongoPackRunLogStore to handle logging of pack run events.
- Developed MongoPackRunStateStore for persisting and retrieving pack run states.
- Implemented unit tests for MongoDB stores to ensure correct functionality.
- Added MongoTaskRunnerTestContext for setting up MongoDB test environment.
- Enhanced PackRunStateFactory to correctly initialize state with gate reasons.

docs/aoc/guard-library.md

@@ -15,6 +15,7 @@ forbidden fields are rejected long before they reach MongoDB.
 - `IAocGuard` / `AocWriteGuard` — validate JSON payloads and emit `AocGuardResult`.
 - `AocGuardOptions` — toggles for signature enforcement, tenant requirements, and required top-level fields.
 - `AocViolation` / `AocViolationCode` — structured violations surfaced to callers.
+- `AocError` — canonical error DTO (`code`, `message`, `violations[]`) re-used by HTTP helpers, CLI tooling, and telemetry.
 - `ServiceCollectionExtensions.AddAocGuard()` — DI helper that registers the singleton guard.
 - `AocGuardExtensions.ValidateOrThrow()` — throws `AocGuardException` when validation fails.
 
@@ -75,7 +76,22 @@ Key points:
   can yield multiple payloads (e.g. batch ingestion) and the filter will validate each one.
 - Prefer the `RequireAocGuard` extension when wiring endpoints; it wraps `AddEndpointFilter`
   and handles single-payload scenarios without additional boilerplate.
-- Wrap guard exceptions with `AocHttpResults.Problem` to ensure clients receive machine-readables codes (`ERR_AOC_00x`).
+- Wrap guard exceptions with `AocHttpResults.Problem` to ensure clients receive machine-readable codes (`ERR_AOC_00x`). The helper now emits the serialized `AocError` under the `error` extension for consumers that want a typed payload.
+
+### Allowed top-level fields
+
+`AocWriteGuard` enforces the contract’s top-level allowlist: `_id`, `tenant`, `source`, `upstream`,
+`content`, `identifiers`, `linkset`, `supersedes`, `createdAt`/`created_at`, `ingestedAt`/`ingested_at`, and `attributes`.
+Unknown fields produce `ERR_AOC_007` violations. When staging schema changes, extend the allowlist through
+`AocGuardOptions.AllowedTopLevelFields`:
+
+```csharp
+builder.Services.Configure<AocGuardOptions>(options =>
+{
+    options.AllowedTopLevelFields =
+        options.AllowedTopLevelFields.Add("experimental_field");
+});
+```
 
 ## Worker / repository usage
 
@@ -100,6 +116,7 @@ public sealed class AdvisoryRawRepository
 ## Configuration tips
 
 - Adjust `AocGuardOptions.RequiredTopLevelFields` when staging new schema changes. All configured names are case-insensitive.
+- Extend `AllowedTopLevelFields` for temporary schema experiments so that guard runs stay clean while the contract is updated.
 - Set `RequireSignatureMetadata = false` for legacy feeds that do not provide signature envelopes yet; track the waiver in the module backlog.
 - Use module-specific wrappers (`AddConcelierAocGuards`, `AddExcititorAocGuards`) to combine guard registration with domain exceptions and metrics.