feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/Policy/StellaOps.Policy.Engine/Console/ConsoleSimulationDiffService.cs

@@ -83,11 +83,6 @@ internal sealed class ConsoleSimulationDiffService
         foreach (var artifact in artifacts.OrderBy(a => a.ArtifactDigest, StringComparer.Ordinal))
         {
             var baseSeed = HashToBytes($"{policyVersion}:{artifact.ArtifactDigest}:{seed}");
-            var include = baseSeed[0] % 7 != 0; // occasionally drop to simulate removal
-            if (!include)
-            {
-                continue;
-            }
 
             var findingId = CreateDeterministicId("fid", policyVersion, artifact.ArtifactDigest, seed.ToString());
             var severity = SeverityOrder[baseSeed[1] % SeverityOrder.Length];
@@ -102,7 +97,12 @@ internal sealed class ConsoleSimulationDiffService
                 Severity: severity,
                 FiredRules: new[] { ruleId }));
 
-            // Add a secondary finding for variability if budget allows
+            if (results.Count >= maxFindings)
+            {
+                break;
+            }
+
+            // Add a secondary finding for variability if budget allows (deterministic)
             if (results.Count < maxFindings && baseSeed[4] % 5 == 0)
             {
                 var secondaryId = CreateDeterministicId("fid", policyVersion, artifact.ArtifactDigest, seed + "-b");
@@ -124,7 +124,10 @@ internal sealed class ConsoleSimulationDiffService
             }
         }
 
-        return results;
+        return results
+            .OrderBy(r => r.FindingId, StringComparer.Ordinal)
+            .Take(maxFindings)
+            .ToList();
     }
 
     private static ConsoleSeverityBreakdown BuildSeverityBreakdown(IReadOnlyList<SimulationFindingResult> findings)