Add tests for SBOM generation determinism across multiple formats

- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.

docs2/security/row-level-security.md

@@ -0,0 +1,21 @@
+# Row-level security
+
+Purpose
+- Enforce tenant isolation at the database level with RLS policies.
+
+Strategy
+- Apply RLS to tenant-scoped tables and views.
+- Require app.tenant_id session setting on every connection.
+- Deny access when tenant context is missing.
+
+Policy evaluation
+- Policies filter rows by tenant_id and optional scope.
+- Admin bypass uses explicit roles with audited access.
+
+Validation
+- Run cross-tenant read and write tests in staging.
+- Include RLS checks in deterministic replay suites.
+
+Related references
+- data/postgresql-patterns.md
+- docs/operations/rls-and-data-isolation.md