refactor: inject TimeProvider/IGuidProvider across multiple modules - DET-006 to DET-010

DET-006 Provenance module: Skipped - already uses TimeProvider in production code

DET-007 ReachGraph module:
- PostgresReachGraphRepository: Added TimeProvider for fallback timestamp in StoreAsync

DET-008 Registry module:
- RegistryTokenIssuer: Added IGuidProvider for JWT ID (jti) generation
- Added StellaOps.Determinism.Abstractions project reference

DET-009 Replay module:
- ReplayEngine: Added TimeProvider for ExecutedAt timestamp
- ReplayResult.Failed: Added optional executedAt parameter for determinism
- ReplayManifestExporter: Added TimeProvider constructor, replaced DateTimeOffset.UtcNow
- FeedSnapshotCoordinatorService: Updated GenerateSnapshotId to use injected TimeProvider
- ExportMetadataInfo: Made ExportedAt required (callers must provide explicitly)
- PolicySimulationInputLock: Made GeneratedAt required (callers must provide explicitly)

DET-010 RiskEngine module: Skipped - no determinism issues found

All changes maintain backward compatibility through optional parameters with system defaults.

src/__Libraries/StellaOps.ReachGraph.Persistence/PostgresReachGraphRepository.cs

@@ -21,6 +21,7 @@ public sealed class PostgresReachGraphRepository : IReachGraphRepository
     private readonly CanonicalReachGraphSerializer _serializer;
     private readonly ReachGraphDigestComputer _digestComputer;
     private readonly ILogger<PostgresReachGraphRepository> _logger;
+    private readonly TimeProvider _timeProvider;
 
     private static readonly JsonSerializerOptions JsonOptions = new()
     {
@@ -31,12 +32,14 @@ public sealed class PostgresReachGraphRepository : IReachGraphRepository
         NpgsqlDataSource dataSource,
         CanonicalReachGraphSerializer serializer,
         ReachGraphDigestComputer digestComputer,
-        ILogger<PostgresReachGraphRepository> logger)
+        ILogger<PostgresReachGraphRepository> logger,
+        TimeProvider? timeProvider = null)
     {
         _dataSource = dataSource ?? throw new ArgumentNullException(nameof(dataSource));
         _serializer = serializer ?? throw new ArgumentNullException(nameof(serializer));
         _digestComputer = digestComputer ?? throw new ArgumentNullException(nameof(digestComputer));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _timeProvider = timeProvider ?? TimeProvider.System;
     }
 
     /// <inheritdoc />
@@ -97,7 +100,7 @@ public sealed class PostgresReachGraphRepository : IReachGraphRepository
         });
 
         var created = result.HasValue;
-        var storedAt = result ?? DateTimeOffset.UtcNow;
+        var storedAt = result ?? _timeProvider.GetUtcNow();
 
         _logger.LogInformation(
             "{Action} reachability graph {Digest} for artifact {Artifact}",