Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/provenance/backfill.md

@@ -0,0 +1,24 @@
+# Provenance backfill
+
+Purpose
+- Backfill missing provenance records with deterministic ordering.
+
+Inputs
+- Attestation inventory (NDJSON) with subject and digest data.
+- Subject to Rekor map for resolving transparency entries.
+
+Procedure
+1. Validate inventory records (UUID or ULID and digest formats).
+2. Resolve each subject to a Rekor entry; record gaps and skip if missing.
+3. Emit backfilled provenance events using a backfill mode that preserves ordering.
+4. Log every backfilled subject and Rekor digest pair as NDJSON.
+5. Repeat until gaps are zero and record completion in audit logs.
+
+Determinism
+- Sort by subject then Rekor entry before processing.
+- Use canonical JSON writers and UTC timestamps.
+
+Related references
+- provenance/inline-provenance.md
+- provenance/attestation-workflow.md
+- docs/provenance/prov-backfill-plan.md