Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/operations/airgap-runbooks.md

@@ -6,6 +6,30 @@ Core runbooks
 - Quarantine: isolate bundles with hash or signature mismatches.
 - Sealed startup diagnostics: confirm egress block and time anchor validity.
 
+Offline kit management
+- Generate full or delta kits in connected environments.
+- Verify kit hash and signature before transfer.
+- Import and install kit, then confirm component freshness.
+
+Feed updates
+- Use delta kits for smaller updates.
+- Roll back to previous snapshot when feeds introduce regressions.
+- Track feed age and kit expiry thresholds.
+
+Scanning in air-gap mode
+- Scan local images or SBOMs without registry pull.
+- Generate SBOMs locally and scan from file.
+- Force offline feeds when required by policy.
+
+Verification in air-gap mode
+- Verify proof bundles offline with local trust roots.
+- Export and import trust bundles for signer and CA rotation.
+- Run score replay with frozen timestamps if needed.
+
+Health checks
+- Monitor kit age, feed freshness, trust store validity, disk usage.
+- Use deterministic health checks and keep results for audit.
+
 Import and verify
 - Validate bundle hash, manifest entries, and schema checks.
 - Record import receipt with operator, time anchor, and manifest hash.