feat: Implement MongoDB orchestrator storage with registry, commands, and heartbeats

- Added NullAdvisoryObservationEventTransport for handling advisory observation events.
- Created IOrchestratorRegistryStore interface for orchestrator registry operations.
- Implemented MongoOrchestratorRegistryStore for MongoDB interactions with orchestrator data.
- Defined OrchestratorCommandDocument and OrchestratorCommandRecord for command handling.
- Added OrchestratorHeartbeatDocument and OrchestratorHeartbeatRecord for heartbeat tracking.
- Created OrchestratorRegistryDocument and OrchestratorRegistryRecord for registry management.
- Developed tests for orchestrator collections migration and MongoOrchestratorRegistryStore functionality.
- Introduced AirgapImportRequest and AirgapImportValidator for air-gapped VEX bundle imports.
- Added incident mode rules sample JSON for notifier configuration.

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -603,6 +603,33 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         Assert.Equal("GHSA-2025-0001", evidence!.AdvisoryKey);
         Assert.Equal(2, evidence.Records.Count);
         Assert.All(evidence.Records, record => Assert.Equal("tenant-a", record.Tenant));
+        Assert.Null(evidence.Attestation);
+    }
+
+    [Fact]
+    public async Task AdvisoryEvidenceEndpoint_AttachesAttestationWhenBundleProvided()
+    {
+        await SeedAdvisoryRawDocumentsAsync(
+            CreateAdvisoryRawDocument("tenant-a", "vendor-x", "GHSA-2025-0003", "sha256:201", new BsonDocument("id", "GHSA-2025-0003:1")));
+
+        var repoRoot = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..", "..", "..", "..", "..", "..", ".."));
+        var sampleDir = Path.Combine(repoRoot, "docs", "samples", "evidence-bundle");
+        var tarPath = Path.Combine(sampleDir, "evidence-bundle-m0.tar.gz");
+        var manifestPath = Path.Combine(sampleDir, "manifest.json");
+        var transparencyPath = Path.Combine(sampleDir, "transparency.json");
+
+        using var client = _factory.CreateClient();
+        var requestUri = $"/vuln/evidence/advisories/GHSA-2025-0003?tenant=tenant-a&bundlePath={Uri.EscapeDataString(tarPath)}&manifestPath={Uri.EscapeDataString(manifestPath)}&transparencyPath={Uri.EscapeDataString(transparencyPath)}&pipelineVersion=git:test-sha";
+        var response = await client.GetAsync(requestUri);
+
+        response.EnsureSuccessStatusCode();
+        var evidence = await response.Content.ReadFromJsonAsync<AdvisoryEvidenceResponse>();
+
+        Assert.NotNull(evidence);
+        Assert.NotNull(evidence!.Attestation);
+        Assert.Equal("evidence-bundle-m0", evidence.Attestation!.SubjectName);
+        Assert.Equal("git:test-sha", evidence.Attestation.PipelineVersion);
+        Assert.Equal(tarPath, evidence.Attestation.EvidenceBundlePath);
     }
 
     [Fact]