feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

src/StellaOps.Scanner.Analyzers.Lang.Rust/AGENTS.md

@@ -0,0 +1,29 @@
+# StellaOps.Scanner.Analyzers.Lang.Rust — Agent Charter
+
+## Role
+Develop the Rust analyzer plug-in that resolves crates from metadata (`.fingerprint`, Cargo.lock, embedded markers) and provides deterministic fallbacks for stripped binaries.
+
+## Scope
+- Locate Cargo metadata in container layers (registry cache, target fingerprints, embedded Git info).
+- Parse symbol tables / section data to heuristically identify crates when metadata missing, tagging provenance appropriately.
+- Integrate binary hash fallback with quiet provenance classification.
+- Package plug-in manifest, determinism fixtures, and performance/coverage benchmarks.
+
+## Out of Scope
+- Native linker analysis beyond crate attribution.
+- Fetching Cargo registry metadata from the network.
+- Policy decisions or UI surfacing.
+
+## Expectations
+- Accurate crate attribution (≥85 % on curated fixtures) with explicit heuristic labeling.
+- Analyzer runtime <1 s over 500 binary corpus; minimal allocations through pooling.
+- Offline-first; rely on local Cargo data.
+- Telemetry capturing heuristic vs verified evidence ratios.
+
+## Dependencies
+- Shared language analyzer infrastructure; Worker dispatcher; optionally EntryTrace hints for runtime coverage.
+
+## Testing & Artifacts
+- Fixtures for cargo workspaces, release builds, stripped binaries, vendor caches.
+- Determinism + benchmark artifacts comparing to competitor scanners.
+- ADR documenting heuristic boundaries + risk mitigations.

src/StellaOps.Scanner.Analyzers.Lang.Rust/GlobalUsings.cs

@@ -0,0 +1,7 @@
+global using System;
+global using System.Collections.Generic;
+global using System.IO;
+global using System.Threading;
+global using System.Threading.Tasks;
+
+global using StellaOps.Scanner.Analyzers.Lang;

src/StellaOps.Scanner.Analyzers.Lang.Rust/Placeholder.cs

@@ -0,0 +1,6 @@
+namespace StellaOps.Scanner.Analyzers.Lang.Rust;
+
+internal static class Placeholder
+{
+    // Analyzer implementation will be added during Sprint LA5.
+}

src/StellaOps.Scanner.Analyzers.Lang.Rust/StellaOps.Scanner.Analyzers.Lang.Rust.csproj

@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <EnableDefaultItems>false</EnableDefaultItems>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Compile Include="**\\*.cs" Exclude="obj\\**;bin\\**" />
+    <EmbeddedResource Include="**\\*.json" Exclude="obj\\**;bin\\**" />
+    <None Include="**\\*" Exclude="**\\*.cs;**\\*.json;bin\\**;obj\\**" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\StellaOps.Scanner.Analyzers.Lang\StellaOps.Scanner.Analyzers.Lang.csproj" />
+  </ItemGroup>
+</Project>

src/StellaOps.Scanner.Analyzers.Lang.Rust/TASKS.md

@@ -0,0 +1,10 @@
+# Rust Analyzer Task Flow
+
+| Seq | ID | Status | Depends on | Description | Exit Criteria |
+|-----|----|--------|------------|-------------|---------------|
+| 1 | SCANNER-ANALYZERS-LANG-10-306A | TODO | SCANNER-ANALYZERS-LANG-10-307 | Parse Cargo metadata (`Cargo.lock`, `.fingerprint`, `.metadata`) and map crates to components with evidence. | Fixtures confirm crate attribution ≥85 % coverage; metadata normalized; evidence includes path + hash. |
+| 2 | SCANNER-ANALYZERS-LANG-10-306B | TODO | SCANNER-ANALYZERS-LANG-10-306A | Implement heuristic classifier using ELF section names, symbol mangling, and `.comment` data for stripped binaries. | Heuristic output flagged as `heuristic`; regression tests ensure no false “observed” classifications. |
+| 3 | SCANNER-ANALYZERS-LANG-10-306C | TODO | SCANNER-ANALYZERS-LANG-10-306B | Integrate binary hash fallback (`bin:{sha256}`) and tie into shared quiet provenance helpers. | Fallback path deterministic; shared helpers reused; tests verify consistent hashing. |
+| 4 | SCANNER-ANALYZERS-LANG-10-307R | TODO | SCANNER-ANALYZERS-LANG-10-306C | Finalize shared helper usage (license, usage flags) and concurrency-safe caches. | Analyzer uses shared utilities; concurrency tests pass; no race conditions. |
+| 5 | SCANNER-ANALYZERS-LANG-10-308R | TODO | SCANNER-ANALYZERS-LANG-10-307R | Determinism fixtures + performance benchmarks; compare against competitor heuristic coverage. | Fixtures `Fixtures/lang/rust/` committed; determinism guard; benchmark shows ≥15 % better coverage vs competitor. |
+| 6 | SCANNER-ANALYZERS-LANG-10-309R | TODO | SCANNER-ANALYZERS-LANG-10-308R | Package plug-in manifest + Offline Kit documentation; ensure Worker integration. | Manifest copied; Worker loads analyzer; Offline Kit doc updated. |