feat(services): pre-session batch across workflow / notifier / notify / cli / libs / misc

Bundled pre-session work from multiple sprints and background refactors:
- src/Workflow: new workflow renderer work (ElkSharp-related)
- src/Notifier: SPRINT_20260420_013 retire orphan digest scheduler path
- src/Notify: SPRINT_20260422_001 notify compat leftovers (non-DEPRECATE)
- src/__Libraries: shared library updates (audit emission surfaces + misc)
- src/Cli: crypto commands + db group + tests
- src/AirGap, src/BinaryIndex, src/AdvisoryAI, src/Replay, src/Findings:
  small module updates
- scripts/test-targeted-xunit.ps1: xunit test runner tweaks

File-level granularity preserved for blame.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/test-targeted-xunit.ps1

@@ -7,8 +7,11 @@
   Some Stella Ops test projects run under Microsoft Testing Platform with the
   xUnit v3 in-process runner. In that mode, `dotnet test --filter` may be
   ignored, which makes targeted verification misleading. This helper rebuilds
-  the requested test project if needed, resolves the output test assembly, and
-  invokes `dotnet exec <test-dll>` with xUnit's native filter arguments.
+  the requested test project if needed, then executes the targeted test runner
+  using the safest path for that project:
+  - `dotnet exec <test-dll>` for standard library-style test assemblies
+  - `dotnet run --project <test-project> -- ...` for ASP.NET host tests that
+    rely on `Microsoft.AspNetCore.Mvc.Testing` loader semantics
 
 .PARAMETER Project
   Path to the test `.csproj`.
@@ -42,9 +45,9 @@
   Skip the project build and run the existing test DLL.
 
 .PARAMETER BuildProjectReferences
-  Whether to build project references. Defaults to `$false` to keep targeted
-  verification fast and avoid broad graph rebuilds when outputs are already
-  available.
+  Build project references as part of the scoped `dotnet build`. Use this for
+  WebApplicationFactory-style tests and other hosts that need transitive runtime
+  assemblies copied into the output folder.
 
 .PARAMETER AdditionalRunnerArgument
   Additional raw xUnit runner arguments appended after the generated filters.
@@ -63,7 +66,7 @@ param(
     [string]$Configuration = 'Debug',
     [string]$Reporter = 'verbose',
     [switch]$SkipBuild,
-    [bool]$BuildProjectReferences = $false,
+    [switch]$BuildProjectReferences,
     [string[]]$AdditionalRunnerArgument = @()
 )
 
@@ -101,6 +104,7 @@ function Get-ProjectMetadata {
     $assemblyName = $null
     $targetFramework = $null
     $targetFrameworks = $null
+    $usesMvcTesting = $false
 
     foreach ($group in $propertyGroups) {
         $assemblyNameNode = $group.SelectSingleNode('AssemblyName')
@@ -119,6 +123,19 @@ function Get-ProjectMetadata {
         }
     }
 
+    $packageReferences = @($projectXml.SelectNodes('/Project/ItemGroup/PackageReference'))
+    foreach ($packageReference in $packageReferences) {
+        $packageId = $packageReference.GetAttribute('Include')
+        if ([string]::IsNullOrWhiteSpace($packageId)) {
+            $packageId = $packageReference.GetAttribute('Update')
+        }
+
+        if ([string]::Equals($packageId, 'Microsoft.AspNetCore.Mvc.Testing', [System.StringComparison]::OrdinalIgnoreCase)) {
+            $usesMvcTesting = $true
+            break
+        }
+    }
+
     if (-not $assemblyName) {
         $assemblyName = [System.IO.Path]::GetFileNameWithoutExtension($ProjectPath)
     }
@@ -127,6 +144,7 @@ function Get-ProjectMetadata {
         AssemblyName = $assemblyName
         TargetFramework = $targetFramework
         TargetFrameworks = $targetFrameworks
+        UsesMvcTesting = $usesMvcTesting
     }
 }
 
@@ -220,7 +238,8 @@ $projectDirectory = Split-Path -Parent $projectPath
 $assemblyPath = Join-Path $projectDirectory "bin\$Configuration\$resolvedFramework\$($metadata.AssemblyName).dll"
 
 if (-not $SkipBuild) {
-    $buildProjectReferencesValue = if ($BuildProjectReferences) { 'true' } else { 'false' }
+    $shouldBuildProjectReferences = $BuildProjectReferences.IsPresent -or $metadata.UsesMvcTesting
+    $buildProjectReferencesValue = if ($shouldBuildProjectReferences) { 'true' } else { 'false' }
 
     $buildArguments = @(
         'build',
@@ -249,11 +268,28 @@ if (-not (Test-Path -LiteralPath $assemblyPath)) {
     throw "Compiled test assembly not found: $assemblyPath"
 }
 
-$runnerArguments = @(
-    'exec',
-    $assemblyPath,
-    '-noLogo'
-)
+$runnerArguments = if ($metadata.UsesMvcTesting) {
+    $arguments = @(
+        'run',
+        '--no-build',
+        '--project', $projectPath,
+        '-c', $Configuration
+    )
+
+    if ($resolvedFramework) {
+        $arguments += @('-f', $resolvedFramework)
+    }
+
+    $arguments += '--'
+    $arguments
+}
+else {
+    @(
+        'exec',
+        $assemblyPath,
+        '-noLogo'
+    )
+}
 
 if (-not [string]::IsNullOrWhiteSpace($Reporter)) {
     $runnerArguments += @('-reporter', $Reporter)
@@ -283,6 +319,11 @@ foreach ($value in $AdditionalRunnerArgument) {
     $runnerArguments += $value
 }
 
-Write-Host "Running targeted xUnit assembly $assemblyPath"
+if ($metadata.UsesMvcTesting) {
+    Write-Host "Running targeted xUnit project runner for $projectPath"
+}
+else {
+    Write-Host "Running targeted xUnit assembly $assemblyPath"
+}
 & dotnet @runnerArguments
 exit $LASTEXITCODE