Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/risk/explainability.md

@@ -0,0 +1,28 @@
+# Risk explainability
+
+Purpose
+- Provide per-factor contributions with provenance and gating rationale.
+
+Explainability envelope
+- job_id, tenant_id, context_id
+- profile_id, profile_version, profile_hash
+- finding_id, raw_score, normalized_score, severity
+- signal_values and signal_contributions
+- override_applied, override_reason, gates_triggered
+- scored_at and provenance hashes
+
+UI and CLI expectations
+- Deterministic ordering by factor type, source, then timestamp.
+- Highlight top contributors and gates.
+- Export Center bundles include explain payload and manifest hashes.
+
+Determinism and offline
+- Fixtures under docs/risk/samples/explain/ with SHA256SUMS.
+- No live calls in examples or captures.
+
+Related references
+- risk/overview.md
+- risk/factors.md
+- risk/formulas.md
+- risk/profiles.md
+- risk/api.md