feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

src/Zastava/__Tests/StellaOps.Zastava.Webhook.Tests/Admission/AdmissionResponseBuilderTests.cs

@@ -188,4 +188,42 @@ public sealed class AdmissionResponseBuilderTests
         var builder = new AdmissionResponseBuilder();
         Assert.Throws<ArgumentException>(() => builder.Build(context, evaluation));
     }
+
+    [Fact]
+    public void Build_ThrowsWhenNoImages()
+    {
+        using var document = JsonDocument.Parse("""
+{
+  "metadata": { "namespace": "ops" },
+  "spec": {
+    "containers": []
+  }
+}
+""");
+
+        var pod = document.RootElement;
+        var spec = pod.GetProperty("spec");
+
+        var context = new AdmissionRequestContext(
+            "admission.k8s.io/v1",
+            "AdmissionReview",
+            "uid-999",
+            "ops",
+            new Dictionary<string, string>(),
+            Array.Empty<AdmissionContainerReference>(),
+            pod,
+            spec);
+
+        var evaluation = new RuntimeAdmissionEvaluation
+        {
+            Decisions = Array.Empty<RuntimeAdmissionDecision>(),
+            BackendFailed = false,
+            FailOpenApplied = false,
+            FailureReason = null,
+            TtlSeconds = 60
+        };
+
+        var builder = new AdmissionResponseBuilder();
+        Assert.Throws<ArgumentException>(() => builder.Build(context, evaluation));
+    }
 }