feat: Add documentation and task tracking for Sprints 508 to 514 in Ops & Offline

- Created detailed markdown files for Sprints 508 (Ops Offline Kit), 509 (Samples), 510 (AirGap), 511 (Api), 512 (Bench), 513 (Provenance), and 514 (Sovereign Crypto Enablement) outlining tasks, dependencies, and owners.
- Introduced a comprehensive Reachability Evidence Delivery Guide to streamline the reachability signal process.
- Implemented unit tests for Advisory AI to block known injection patterns and redact secrets.
- Added AuthoritySenderConstraintHelper to manage sender constraints in OpenIddict transactions.

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -9,7 +9,6 @@ using System.Net;
 using System.Net.Http.Json;
 using System.Net.Http.Headers;
 using System.Security.Claims;
-using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
 using Microsoft.AspNetCore.Builder;
@@ -44,6 +43,7 @@ using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using StellaOps.Concelier.WebService.Diagnostics;
 using Microsoft.IdentityModel.Tokens;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Concelier.WebService.Tests;
 
@@ -411,10 +411,11 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
                 tenant: "tenant-verify-violations",
                 vendor: "osv",
                 upstreamId: "GHSA-VERIFY-ERR",
-                contentHash: string.Empty,
+                contentHash: "sha256:verify-err",
                 raw: new BsonDocument
                 {
-                    { "id", "GHSA-VERIFY-ERR" }
+                    { "id", "GHSA-VERIFY-ERR" },
+                    { "severity", "critical" }
                 }));
 
         using var client = _factory.CreateClient();
@@ -1492,16 +1493,16 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
     }
 
     private static readonly DateTimeOffset DefaultIngestTimestamp = new(2025, 1, 1, 0, 0, 0, TimeSpan.Zero);
+    private static readonly ICryptoHash Hash = CryptoHashFactory.CreateDefault();
 
     private static string ComputeContentHash(BsonDocument rawDocument)
     {
-        using var sha256 = SHA256.Create();
         var canonical = rawDocument.ToJson(new JsonWriterSettings
         {
             OutputMode = JsonOutputMode.RelaxedExtendedJson
         });
-        var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(canonical));
-        return $"sha256:{Convert.ToHexString(bytes).ToLowerInvariant()}";
+        var digest = Hash.ComputeHashHex(Encoding.UTF8.GetBytes(canonical), HashAlgorithms.Sha256);
+        return $"sha256:{digest}";
     }
 
     private static string ComputeDeterministicContentHash(string upstreamId)
@@ -1522,9 +1523,8 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             return value.Trim();
         }
 
-        using var sha256 = SHA256.Create();
-        var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(raw.GetRawText()));
-        return $"sha256:{Convert.ToHexString(bytes).ToLowerInvariant()}";
+        var digest = Hash.ComputeHashHex(Encoding.UTF8.GetBytes(raw.GetRawText()), HashAlgorithms.Sha256);
+        return $"sha256:{digest}";
     }
 
     private sealed record ReplayResponse(