refactor: inject TimeProvider/IGuidProvider across multiple modules - DET-006 to DET-010

DET-006 Provenance module: Skipped - already uses TimeProvider in production code

DET-007 ReachGraph module:
- PostgresReachGraphRepository: Added TimeProvider for fallback timestamp in StoreAsync

DET-008 Registry module:
- RegistryTokenIssuer: Added IGuidProvider for JWT ID (jti) generation
- Added StellaOps.Determinism.Abstractions project reference

DET-009 Replay module:
- ReplayEngine: Added TimeProvider for ExecutedAt timestamp
- ReplayResult.Failed: Added optional executedAt parameter for determinism
- ReplayManifestExporter: Added TimeProvider constructor, replaced DateTimeOffset.UtcNow
- FeedSnapshotCoordinatorService: Updated GenerateSnapshotId to use injected TimeProvider
- ExportMetadataInfo: Made ExportedAt required (callers must provide explicitly)
- PolicySimulationInputLock: Made GeneratedAt required (callers must provide explicitly)

DET-010 RiskEngine module: Skipped - no determinism issues found

All changes maintain backward compatibility through optional parameters with system defaults.

src/__Libraries/StellaOps.Replay/Engine/ReplayEngine.cs

@@ -17,17 +17,20 @@ public sealed class ReplayEngine : IReplayEngine
     private readonly IPolicyLoader _policyLoader;
     private readonly IScannerFactory _scannerFactory;
     private readonly ILogger<ReplayEngine> _logger;
+    private readonly TimeProvider _timeProvider;
 
     public ReplayEngine(
         IFeedLoader feedLoader,
         IPolicyLoader policyLoader,
         IScannerFactory scannerFactory,
-        ILogger<ReplayEngine> logger)
+        ILogger<ReplayEngine> logger,
+        TimeProvider? timeProvider = null)
     {
         _feedLoader = feedLoader;
         _policyLoader = policyLoader;
         _scannerFactory = scannerFactory;
         _logger = logger;
+        _timeProvider = timeProvider ?? TimeProvider.System;
     }
 
     public async Task<ReplayResult> ReplayAsync(
@@ -73,7 +76,7 @@ public sealed class ReplayEngine : IReplayEngine
             VerdictJson = verdictJson,
             VerdictDigest = verdictDigest,
             EvidenceIndex = scanResult.EvidenceIndex,
-            ExecutedAt = DateTimeOffset.UtcNow,
+            ExecutedAt = _timeProvider.GetUtcNow(),
             DurationMs = scanResult.DurationMs
         };
     }

src/__Libraries/StellaOps.Replay/Models/ReplayModels.cs

@@ -14,13 +14,17 @@ public sealed record ReplayResult
     public long DurationMs { get; init; }
     public IReadOnlyList<string>? Errors { get; init; }
 
-    public static ReplayResult Failed(string runId, string message, IReadOnlyList<string> errors) =>
+    public static ReplayResult Failed(
+        string runId,
+        string message,
+        IReadOnlyList<string> errors,
+        DateTimeOffset? executedAt = null) =>
         new()
         {
             RunId = runId,
             Success = false,
             Errors = errors.Prepend(message).ToList(),
-            ExecutedAt = DateTimeOffset.UtcNow
+            ExecutedAt = executedAt ?? DateTimeOffset.UtcNow
         };
 }