feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/Policy/StellaOps.Policy.Engine/SelectionJoin/PurlEquivalence.cs

@@ -40,20 +40,21 @@ public sealed class PurlEquivalenceTable
 
         foreach (var group in groups)
         {
-            var normalizedGroup = group
+            var normalizedList = group
                 .Where(p => !string.IsNullOrWhiteSpace(p))
                 .Select(p => p.Trim().ToLowerInvariant())
                 .Distinct()
                 .OrderBy(p => p, StringComparer.Ordinal)
-                .ToImmutableHashSet(StringComparer.OrdinalIgnoreCase);
+                .ToArray();
 
-            if (normalizedGroup.Count < 2)
+            if (normalizedList.Length < 2)
             {
                 continue;
             }
 
-            // First item (lexicographically) is the canonical form
-            var canonical = normalizedGroup.First();
+            // Use an ordered array for canonical; hash-set only for membership
+            var canonical = normalizedList[0];
+            var normalizedGroup = normalizedList.ToImmutableHashSet(StringComparer.OrdinalIgnoreCase);
 
             foreach (var purl in normalizedGroup)
             {