Implement MongoDB-based storage for Pack Run approval, artifact, log, and state management

- Added MongoPackRunApprovalStore for managing approval states with MongoDB.
- Introduced MongoPackRunArtifactUploader for uploading and storing artifacts.
- Created MongoPackRunLogStore to handle logging of pack run events.
- Developed MongoPackRunStateStore for persisting and retrieving pack run states.
- Implemented unit tests for MongoDB stores to ensure correct functionality.
- Added MongoTaskRunnerTestContext for setting up MongoDB test environment.
- Enhanced PackRunStateFactory to correctly initialize state with gate reasons.

docs/dev/BUILDX_PLUGIN_QUICKSTART.md

@@ -72,7 +72,37 @@ The output JSON captures:
 - Provenance placeholder (`expectedDsseSha256`, `nonce`, `attestorUri` when provided). `nonce` is derived deterministically from the image + SBOM metadata so repeated runs produce identical placeholders for identical inputs.
 - Generator metadata and deterministic timestamps.
 
-## 5. (Optional) Send the placeholder to an Attestor
+### 4.1 Persist Surface manifests & payloads (optional)
+
+Pass the new `--surface-*` switches to the `descriptor` command whenever you have Surface artefacts (layer fragments, EntryTrace graph/NDJSON) that should be cached during build-time scans. The plug-in stores the payloads under the configured CAS root (defaults to `--cas`) and emits a manifest pointer that Scanner/WebService can consume later.
+
+```bash
+dotnet out/buildx/StellaOps.Scanner.Sbomer.BuildXPlugin.dll descriptor \
+  --manifest out/buildx \
+  --image "$DIGEST" \
+  --sbom out/buildx-sbom.cdx.json \
+  --surface-layer-fragments out/layer-fragments.json \
+  --surface-entrytrace-graph out/entrytrace-graph.json \
+  --surface-entrytrace-ndjson out/entrytrace.ndjson \
+  --surface-cache-root out/cas \
+  --surface-tenant demo-tenant \
+  --surface-manifest-output out/surface-manifest.json \
+  > out/buildx-descriptor.json
+```
+
+Environment variables mirror the CLI flags when you need deterministic defaults:
+
+| Variable | Purpose |
+|----------|---------|
+| `STELLAOPS_SURFACE_CACHE_ROOT` | CAS/cache directory used for Surface artefacts (defaults to `--cas`). |
+| `STELLAOPS_SURFACE_BUCKET` | Bucket name embedded in `cas://` URIs (default `scanner-artifacts`). |
+| `STELLAOPS_SURFACE_TENANT` | Tenant recorded in the manifest (`default` if omitted). |
+| `STELLAOPS_SURFACE_LAYER_FRAGMENTS` / `...ENTRYTRACE_GRAPH` / `...ENTRYTRACE_NDJSON` | File paths for the respective artefacts. |
+| `STELLAOPS_SURFACE_MANIFEST_OUTPUT` | Optional path where the manifest JSON should be duplicated for CI artefacts. |
+
+Manifests and payloads use the same deterministic layout as Scanner.Worker (`scanner/surface/...`) so WebService and Offline Kit tooling can consume them without rescanning the image.
+
+## 5. (Optional) Send the placeholder to an Attestor
 
 The plug-in can POST the descriptor metadata to an Attestor endpoint, returning once it receives an HTTP 202.