Add integration tests for Proof Chain and Reachability workflows

- Implement ProofChainTestFixture for PostgreSQL-backed integration tests.
- Create StellaOps.Integration.ProofChain project with necessary dependencies.
- Add ReachabilityIntegrationTests to validate call graph extraction and reachability analysis.
- Introduce ReachabilityTestFixture for managing corpus and fixture paths.
- Establish StellaOps.Integration.Reachability project with required references.
- Develop UnknownsWorkflowTests to cover the unknowns lifecycle: detection, ranking, escalation, and resolution.
- Create StellaOps.Integration.Unknowns project with dependencies for unknowns workflow.

src/Cli/StellaOps.Cli/Commands/WitnessCommandGroup.cs

@@ -145,9 +145,9 @@ internal static class WitnessCommandGroup
             Required = true
         };
 
-        var cveOption = new Option<string?>("--cve")
+        var vulnOption = new Option<string?>("--vuln", new[] { "-v" })
         {
-            Description = "Filter witnesses by CVE ID."
+            Description = "Filter witnesses by CVE/vulnerability ID."
         };
 
         var tierOption = new Option<string?>("--tier")
@@ -155,6 +155,11 @@ internal static class WitnessCommandGroup
             Description = "Filter by confidence tier: confirmed, likely, present, unreachable."
         }?.FromAmong("confirmed", "likely", "present", "unreachable");
 
+        var reachableOnlyOption = new Option<bool>("--reachable-only")
+        {
+            Description = "Show only reachable witnesses."
+        };
+
         var formatOption = new Option<string>("--format", new[] { "-f" })
         {
             Description = "Output format: table (default), json."
@@ -168,8 +173,9 @@ internal static class WitnessCommandGroup
         var command = new Command("list", "List witnesses for a scan.")
         {
             scanOption,
-            cveOption,
+            vulnOption,
             tierOption,
+            reachableOnlyOption,
             formatOption,
             limitOption,
             verboseOption
@@ -178,8 +184,9 @@ internal static class WitnessCommandGroup
         command.SetAction(parseResult =>
         {
             var scanId = parseResult.GetValue(scanOption)!;
-            var cve = parseResult.GetValue(cveOption);
+            var vuln = parseResult.GetValue(vulnOption);
             var tier = parseResult.GetValue(tierOption);
+            var reachableOnly = parseResult.GetValue(reachableOnlyOption);
             var format = parseResult.GetValue(formatOption)!;
             var limit = parseResult.GetValue(limitOption);
             var verbose = parseResult.GetValue(verboseOption);
@@ -187,8 +194,9 @@ internal static class WitnessCommandGroup
             return CommandHandlers.HandleWitnessListAsync(
                 services,
                 scanId,
-                cve,
+                vuln,
                 tier,
+                reachableOnly,
                 format,
                 limit,
                 verbose,