feat: Add RustFS artifact object store and migration tool

- Implemented RustFsArtifactObjectStore for managing artifacts in RustFS.
- Added unit tests for RustFsArtifactObjectStore functionality.
- Created a RustFS migrator tool to transfer objects from S3 to RustFS.
- Introduced policy preview and report models for API integration.
- Added fixtures and tests for policy preview and report functionality.
- Included necessary metadata and scripts for cache_pkg package.

docs/ARCHITECTURE_SCANNER.md

@@ -1,6 +1,6 @@
 # component_architecture_scanner.md — **Stella Ops Scanner** (2025Q4)
 
-> **Scope.** Implementation‑ready architecture for the **Scanner** subsystem: WebService, Workers, analyzers, SBOM assembly (inventory & usage), per‑layer caching, three‑way diffs, artifact catalog (MinIO+Mongo), attestation hand‑off, and scale/security posture. This document is the contract between the scanning plane and everything else (Policy, Excititor, Concelier, UI, CLI).
+> **Scope.** Implementation‑ready architecture for the **Scanner** subsystem: WebService, Workers, analyzers, SBOM assembly (inventory & usage), per‑layer caching, three‑way diffs, artifact catalog (RustFS default + Mongo, S3-compatible fallback), attestation hand‑off, and scale/security posture. This document is the contract between the scanning plane and everything else (Policy, Excititor, Concelier, UI, CLI).
 
 ---
 
@@ -23,7 +23,7 @@ src/
  ├─ StellaOps.Scanner.WebService/            # REST control plane, catalog, diff, exports
  ├─ StellaOps.Scanner.Worker/                # queue consumer; executes analyzers
  ├─ StellaOps.Scanner.Models/                # DTOs, evidence, graph nodes, CDX/SPDX adapters
- ├─ StellaOps.Scanner.Storage/               # Mongo repositories; MinIO object client; ILM/GC
+ ├─ StellaOps.Scanner.Storage/               # Mongo repositories; RustFS object client (default) + S3 fallback; ILM/GC
  ├─ StellaOps.Scanner.Queue/                 # queue abstraction (Redis/NATS/RabbitMQ)
  ├─ StellaOps.Scanner.Cache/                 # layer cache; file CAS; bloom/bitmap indexes
  ├─ StellaOps.Scanner.EntryTrace/            # ENTRYPOINT/CMD → terminal program resolver (shell AST)
@@ -81,7 +81,7 @@ The DI extension (`AddScannerQueue`) wires the selected transport, so future add
 ## 2) External dependencies
 
 * **OCI registry** with **Referrers API** (discover attached SBOMs/signatures).
-* **MinIO** (S3‑compatible) for SBOM artifacts; **Object Lock** for immutable classes; **ILM** for TTL.
+* **RustFS** (default, offline-first) for SBOM artifacts; optional S3/MinIO compatibility retained for migration; **Object Lock** semantics emulated via retention headers; **ILM** for TTL.
 * **MongoDB** for catalog, job state, diffs, ILM rules.
 * **Queue** (Redis Streams/NATS/RabbitMQ).
 * **Authority** (on‑prem OIDC) for **OpToks** (DPoP/mTLS).
@@ -133,7 +133,7 @@ No confidences. Either a fact is proven with listed mechanisms, or it is not cla
 * `jobs   { _id, kind, args, state, startedAt, heartbeatAt, endedAt, error }`
 * `lifecycleRules { ruleId, scope, ttlDays, retainIfReferenced, immutable }`
 
-### 3.3 Object store layout (MinIO)
+### 3.3 Object store layout (RustFS)
 
 ```
 layers/<sha256>/sbom.cdx.json.zst
@@ -145,6 +145,13 @@ diffs/<old>_<new>/diff.json.zst
 attest/<artifactSha256>.dsse.json              # DSSE bundle (cert chain + Rekor proof)
 ```
 
+RustFS exposes a deterministic HTTP API (`PUT|GET|DELETE /api/v1/buckets/{bucket}/objects/{key}`).
+Scanner clients tag immutable uploads with `X-RustFS-Immutable: true` and, when retention applies,
+`X-RustFS-Retain-Seconds: <ttlSeconds>`. Additional headers can be injected via
+`scanner.artifactStore.headers` to support custom auth or proxy requirements. Legacy MinIO/S3
+deployments remain supported by setting `scanner.artifactStore.driver = "s3"` during phased
+migrations.
+
 ---
 
 ## 4) REST API (Scanner.WebService)
@@ -396,7 +403,7 @@ scanner:
 * **HA**: WebService horizontal scale; Workers autoscale by queue depth & CPU; distributed locks on layers.
 * **Retention**: ILM rules per artifact class (`short`, `default`, `compliance`); **Object Lock** for compliance artifacts (reports, signed SBOMs).
 * **Upgrades**: bump **cache schema** when analyzer outputs change; WebService triggers refresh of dependent artifacts.
-* **Backups**: Mongo (daily dumps); MinIO (versioned buckets, replication); Rekor v2 DB snapshots.
+* **Backups**: Mongo (daily dumps); RustFS snapshots (filesystem-level rsync/ZFS) or S3 versioning when legacy driver enabled; Rekor v2 DB snapshots.
 
 ---