feat: Add documentation and task tracking for Sprints 508 to 514 in Ops & Offline

- Created detailed markdown files for Sprints 508 (Ops Offline Kit), 509 (Samples), 510 (AirGap), 511 (Api), 512 (Bench), 513 (Provenance), and 514 (Sovereign Crypto Enablement) outlining tasks, dependencies, and owners.
- Introduced a comprehensive Reachability Evidence Delivery Guide to streamline the reachability signal process.
- Implemented unit tests for Advisory AI to block known injection patterns and redact secrets.
- Added AuthoritySenderConstraintHelper to manage sender constraints in OpenIddict transactions.

src/Concelier/__Libraries/StellaOps.Concelier.Connector.Common/Fetch/SourceFetchService.cs

@@ -6,7 +6,6 @@ using System.Linq;
 using System.Net;
 using System.Net.Http;
 using System.Net.Http.Headers;
-using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -19,6 +18,7 @@ using StellaOps.Concelier.RawModels;
 using StellaOps.Concelier.Storage.Mongo;
 using StellaOps.Concelier.Storage.Mongo.Documents;
 using System.Text.Json;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Concelier.Connector.Common.Fetch;
 
@@ -40,15 +40,17 @@ public sealed class SourceFetchService
     private readonly IAdvisoryRawWriteGuard _guard;
     private readonly IAdvisoryLinksetMapper _linksetMapper;
     private readonly string _connectorVersion;
-
-    public SourceFetchService(
-        IHttpClientFactory httpClientFactory,
-        RawDocumentStorage rawDocumentStorage,
-        IDocumentStore documentStore,
-        ILogger<SourceFetchService> logger,
+    private readonly ICryptoHash _hash;
+
+    public SourceFetchService(
+        IHttpClientFactory httpClientFactory,
+        RawDocumentStorage rawDocumentStorage,
+        IDocumentStore documentStore,
+        ILogger<SourceFetchService> logger,
         IJitterSource jitterSource,
         IAdvisoryRawWriteGuard guard,
         IAdvisoryLinksetMapper linksetMapper,
+        ICryptoHash hash,
         TimeProvider? timeProvider = null,
         IOptionsMonitor<SourceHttpClientOptions>? httpClientOptions = null,
         IOptions<MongoStorageOptions>? storageOptions = null)
@@ -60,6 +62,7 @@ public sealed class SourceFetchService
         _jitterSource = jitterSource ?? throw new ArgumentNullException(nameof(jitterSource));
         _guard = guard ?? throw new ArgumentNullException(nameof(guard));
         _linksetMapper = linksetMapper ?? throw new ArgumentNullException(nameof(linksetMapper));
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
         _timeProvider = timeProvider ?? TimeProvider.System;
         _httpClientOptions = httpClientOptions ?? throw new ArgumentNullException(nameof(httpClientOptions));
         _storageOptions = storageOptions ?? throw new ArgumentNullException(nameof(storageOptions));
@@ -103,7 +106,7 @@ public sealed class SourceFetchService
                 }
 
                 var contentBytes = await response.Content.ReadAsByteArrayAsync(cancellationToken).ConfigureAwait(false);
-                var contentHash = Convert.ToHexString(SHA256.HashData(contentBytes)).ToLowerInvariant();
+                var contentHash = _hash.ComputeHashHex(contentBytes, HashAlgorithms.Sha256);
                 var fetchedAt = _timeProvider.GetUtcNow();
                 var contentType = response.Content.Headers.ContentType?.ToString();