Add Authority Advisory AI and API Lifecycle Configuration

- Introduced AuthorityAdvisoryAiOptions and related classes for managing advisory AI configurations, including remote inference options and tenant-specific settings.
- Added AuthorityApiLifecycleOptions to control API lifecycle settings, including legacy OAuth endpoint configurations.
- Implemented validation and normalization methods for both advisory AI and API lifecycle options to ensure proper configuration.
- Created AuthorityNotificationsOptions and its related classes for managing notification settings, including ack tokens, webhooks, and escalation options.
- Developed IssuerDirectoryClient and related models for interacting with the issuer directory service, including caching mechanisms and HTTP client configurations.
- Added support for dependency injection through ServiceCollectionExtensions for the Issuer Directory Client.
- Updated project file to include necessary package references for the new Issuer Directory Client library.

docs/modules/scanner/design/surface-fs.md

@@ -73,7 +73,8 @@ Surface.FS library for .NET hosts provides:
 - `ISurfaceManifestWriter` / `ISurfaceManifestReader` interfaces.
 - Content-addressed path builder (`SurfacePathBuilder`).
 - Tenant namespace isolation and bucket configuration (via Surface.Env).
-- Local cache management (using `SCANNER_SURFACE_CACHE_ROOT` and quota).
+- Local cache abstraction `ISurfaceCache` with default `FileSurfaceCache` implementation (uses `Surface:Cache:Root` / `SCANNER_SURFACE_CACHE_ROOT`, enforces quotas, serialises writes with per-key semaphores).
+- `SurfaceCacheKey` helper that normalises cache entries as `{namespace}/{tenant}/{sha256}`. EntryTrace graphs use the `entrytrace.graph` namespace so Worker/WebService/CLI can share cached results deterministically.
 - Metrics: `surface_manifest_put_seconds`, `surface_manifest_cache_hit_total`, etc.
 
 ## 5. Retention & Eviction
@@ -97,6 +98,10 @@ offline/surface/
 
 Import script calls `PutManifest` for each manifest, verifying digests. This enables Zastava and Scheduler running offline to consume cached data without re-scanning.
 
+### 6.1 EntryTrace Cache Usage
+
+Scanner.Worker serialises EntryTrace graphs into Surface.FS using `SurfaceCacheKey(namespace: "entrytrace.graph", tenant, sha256(options|env|entrypoint))`. At runtime the worker checks the cache before invoking analyzers; cache hits bypass parsing and feed the result store/attestor pipeline directly. The same namespace is consumed by WebService and CLI to retrieve cached graphs for reporting.
+
 ## 7. Security & Tenancy
 
 - Tenant ID is mandatory; Surface.Validation enforces match with Authority token.