feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/Web/StellaOps.Web/scripts/chrome-path.js

@@ -87,15 +87,49 @@ function expandNestedArchives(rootDir = join(__dirname, '..')) {
   return candidates;
 }
 
-function candidatePaths(rootDir = join(__dirname, '..')) {
-  const { env } = process;
-  const baseCandidates = [
-    env.STELLAOPS_CHROMIUM_BIN,
-    env.CHROME_BIN,
-    env.PUPPETEER_EXECUTABLE_PATH,
-    '/usr/bin/chromium-browser',
-    '/usr/bin/chromium',
-    '/usr/bin/google-chrome',
+function candidatePaths(rootDir = join(__dirname, '..')) {
+  const { env } = process;
+  const playwrightBase = join(rootDir, 'node_modules', 'playwright-core', '.local-browsers');
+  const homePlaywrightBase = env.HOME ? join(env.HOME, '.cache', 'ms-playwright') : null;
+  let playwrightChromium = [];
+  try {
+    if (existsSync(playwrightBase)) {
+      playwrightChromium = readdirSync(playwrightBase)
+        .filter((d) => d.startsWith('chromium-'))
+        .map((d) => join(playwrightBase, d, 'chrome-linux', 'chrome'))
+        .concat(
+          readdirSync(playwrightBase)
+            .filter((d) => d.startsWith('chromium-'))
+            .map((d) => join(playwrightBase, d, 'chrome-win', 'chrome.exe')),
+          readdirSync(playwrightBase)
+            .filter((d) => d.startsWith('chromium-'))
+            .map((d) => join(playwrightBase, d, 'chrome-mac', 'Chromium.app', 'Contents', 'MacOS', 'Chromium'))
+        );
+    }
+  } catch {
+    playwrightChromium = [];
+  }
+
+  let homeChromium = [];
+  try {
+    if (homePlaywrightBase && existsSync(homePlaywrightBase)) {
+      homeChromium = readdirSync(homePlaywrightBase)
+        .filter((d) => d.startsWith('chromium'))
+        .map((d) => join(homePlaywrightBase, d, 'chrome-linux', 'chrome'));
+    }
+  } catch {
+    homeChromium = [];
+  }
+
+  const baseCandidates = [
+    env.STELLAOPS_CHROMIUM_BIN,
+    env.CHROME_BIN,
+    env.PUPPETEER_EXECUTABLE_PATH,
+    ...playwrightChromium,
+    ...homeChromium,
+    '/usr/bin/chromium-browser',
+    '/usr/bin/chromium',
+    '/usr/bin/google-chrome',
     '/usr/bin/google-chrome-stable',
     join(rootDir, ...linuxArchivePath),
     join(rootDir, ...windowsArchivePath),