Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/observability-tracing.md

@@ -0,0 +1,27 @@
+# Tracing standards
+
+Goals
+- Consistent distributed tracing across services, workers, and CLI.
+- Safe for offline and air-gapped deployments.
+
+Context propagation
+- Use W3C traceparent and baggage only.
+- Preserve incoming trace_id and create child spans per operation.
+- For async work, attach stored trace context as links rather than a new parent.
+
+Span conventions
+- Names use <component>.<operation> (example: policy.evaluate).
+- Required attributes: tenant, workload, env, region, version, operation, status.
+- HTTP spans: http.method, http.route, http.status_code, net.peer.name, net.peer.port.
+- DB spans: db.system, db.name, db.operation, db.statement (no literals).
+- Message spans: messaging.system, messaging.destination, messaging.operation, messaging.message_id.
+- Errors: status=error with error.code, redacted error.message, retryable.
+
+Sampling
+- Default head sampling: 10% non-prod, 5% prod.
+- Always sample error or audit spans.
+- Override via Tracing__SampleRate per service.
+
+Offline posture
+- No external exporters; emit OTLP to local collector or file.
+- UTC timestamps only.