feat(secrets): Implement secret leak policies and signal binding

- Added `spl-secret-block@1.json` to block deployments with critical or high severity secret findings.
- Introduced `spl-secret-warn@1.json` to warn on secret findings without blocking deployments.
- Created `SecretSignalBinder.cs` to bind secret evidence to policy evaluation signals.
- Developed unit tests for `SecretEvidenceContext` and `SecretSignalBinder` to ensure correct functionality.
- Enhanced `SecretSignalContextExtensions` to integrate secret evidence into signal contexts.

src/Scheduler/StellaOps.Scheduler.WebService/GraphJobs/GraphJobService.cs

@@ -8,18 +8,18 @@ namespace StellaOps.Scheduler.WebService.GraphJobs;
 internal sealed class GraphJobService : IGraphJobService
 {
     private readonly IGraphJobStore _store;
-    private readonly ISystemClock _clock;
+    private readonly TimeProvider _timeProvider;
     private readonly IGraphJobCompletionPublisher _completionPublisher;
     private readonly ICartographerWebhookClient _cartographerWebhook;
 
     public GraphJobService(
         IGraphJobStore store,
-        ISystemClock clock,
+        TimeProvider timeProvider,
         IGraphJobCompletionPublisher completionPublisher,
         ICartographerWebhookClient cartographerWebhook)
     {
         _store = store ?? throw new ArgumentNullException(nameof(store));
-        _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+        _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
         _completionPublisher = completionPublisher ?? throw new ArgumentNullException(nameof(completionPublisher));
         _cartographerWebhook = cartographerWebhook ?? throw new ArgumentNullException(nameof(cartographerWebhook));
     }
@@ -31,7 +31,7 @@ internal sealed class GraphJobService : IGraphJobService
         var trigger = request.Trigger ?? GraphBuildJobTrigger.SbomVersion;
         var metadata = request.Metadata ?? new Dictionary<string, string>(StringComparer.Ordinal);
 
-        var now = _clock.UtcNow;
+        var now = _timeProvider.GetUtcNow();
         var id = GenerateIdentifier("gbj");
         var job = new GraphBuildJob(
             id,
@@ -65,7 +65,7 @@ internal sealed class GraphJobService : IGraphJobService
         var metadata = request.Metadata ?? new Dictionary<string, string>(StringComparer.Ordinal);
         var trigger = request.Trigger ?? GraphOverlayJobTrigger.Policy;
 
-        var now = _clock.UtcNow;
+        var now = _timeProvider.GetUtcNow();
         var id = GenerateIdentifier("goj");
 
         var job = new GraphOverlayJob(
@@ -98,7 +98,7 @@ internal sealed class GraphJobService : IGraphJobService
             throw new ValidationException("Completion requires status completed, failed, or cancelled.");
         }
 
-        var occurredAt = request.OccurredAt == default ? _clock.UtcNow : request.OccurredAt.ToUniversalTime();
+        var occurredAt = request.OccurredAt == default ? _timeProvider.GetUtcNow() : request.OccurredAt.ToUniversalTime();
         var graphSnapshotId = Normalize(request.GraphSnapshotId);
         var correlationId = Normalize(request.CorrelationId);
         var resultUri = Normalize(request.ResultUri);
@@ -369,7 +369,7 @@ internal sealed class GraphJobService : IGraphJobService
 
     public async Task<OverlayLagMetricsResponse> GetOverlayLagMetricsAsync(string tenantId, CancellationToken cancellationToken)
     {
-        var now = _clock.UtcNow;
+        var now = _timeProvider.GetUtcNow();
         var overlayJobs = await _store.GetOverlayJobsAsync(tenantId, cancellationToken);
 
         var pending = overlayJobs.Count(job => job.Status == GraphJobStatus.Pending);