Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/operations/proof-verification.md

@@ -0,0 +1,37 @@
+# Proof verification
+
+Purpose
+- Verify DSSE bundles and transparency proofs for scan and score evidence.
+
+Components
+- DSSE envelope and signature bundle.
+- Certificate chain and trust roots.
+- Rekor inclusion proof and checkpoint when online.
+
+Basic verification
+- Verify DSSE signature against trusted roots.
+- Confirm subject digest matches expected artifact.
+- Validate Merkle inclusion proof when available.
+
+Offline verification
+- Use embedded proofs and local trust bundles.
+- Skip online Rekor queries in sealed mode.
+- Record verification results in timeline events.
+
+Transparency log integration
+- Check Rekor entry status and inclusion proof.
+- When Rekor is unavailable, rely on cached checkpoint and proofs.
+
+Troubleshooting cues
+- DSSE signature invalid: check key rotation or trust anchors.
+- Merkle root mismatch: verify checkpoint and bundle integrity.
+- Certificate chain failure: refresh trust roots.
+
+Monitoring
+- Track verification latency and failure counts.
+- Alert on certificate expiry or rising verification failures.
+
+Related references
+- provenance/attestation-workflow.md
+- release/promotion-attestations.md
+- docs/operations/proof-verification-runbook.md