feat(scanner): Complete PoE implementation with Windows compatibility fix

- Fix namespace conflicts (Subgraph → PoESubgraph)
- Add hash sanitization for Windows filesystem (colon → underscore)
- Update all test mocks to use It.IsAny<>()
- Add direct orchestrator unit tests
- All 8 PoE tests now passing (100% success rate)
- Complete SPRINT_3500_0001_0001 documentation

Fixes compilation errors and Windows filesystem compatibility issues.
Tests: 8/8 passing
Files: 8 modified, 1 new test, 1 completion report

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/Scanner/StellaOps.Scanner.Worker/Orchestration/PoEOrchestrator.cs

@@ -4,7 +4,6 @@ using Microsoft.Extensions.Logging;
 using StellaOps.Attestor;
 using StellaOps.Scanner.Core.Configuration;
 using StellaOps.Scanner.Reachability;
-using StellaOps.Attestor;
 using StellaOps.Signals.Storage;
 
 namespace StellaOps.Scanner.Worker.Orchestration;
@@ -108,8 +107,8 @@ public class PoEOrchestrator
                 results.Add(poeResult);
 
                 _logger.LogInformation(
-                    "Generated PoE for {VulnId}: {Hash} ({Size} bytes)",
-                    vulnId, poeResult.PoeHash, poeResult.PoEBytes.Length);
+                    "Generated PoE for {VulnId}: {Hash} (signed: {IsSigned})",
+                    vulnId, poeResult.PoEHash, poeResult.IsSigned);
             }
             catch (Exception ex)
             {
@@ -168,16 +167,15 @@ public class PoEOrchestrator
             cancellationToken);
 
         // Store in CAS
-        await _casStore.StoreAsync(poeBytes, dsseBytes, cancellationToken);
+        var poeRef = await _casStore.StoreAsync(poeBytes, dsseBytes, cancellationToken);
 
         return new PoEResult(
             VulnId: subgraph.VulnId,
             ComponentRef: subgraph.ComponentRef,
-            PoeHash: poeHash,
-            PoEBytes: poeBytes,
-            DsseBytes: dsseBytes,
-            NodeCount: subgraph.Nodes.Count,
-            EdgeCount: subgraph.Edges.Count
+            PoEHash: poeHash,
+            PoERef: poeRef,
+            IsSigned: dsseBytes != null && dsseBytes.Length > 0,
+            PathCount: subgraph.Edges.Count
         );
     }
 
@@ -207,47 +205,9 @@ public class PoEOrchestrator
         {
             $"1. Build container image: {context.ImageDigest}",
             $"2. Run scanner: stella scan --image {context.ImageDigest} --config {context.ConfigPath ?? "etc/scanner.yaml"}",
-            $"3. Extract reachability graph with maxDepth={context.ResolverOptions?.MaxDepth ?? 10}",
+            $"3. Extract reachability graph and resolve paths",
             $"4. Resolve {subgraph.VulnId} → {subgraph.ComponentRef} to vulnerable symbols",
             $"5. Compute paths from {subgraph.EntryRefs.Length} entry points to {subgraph.SinkRefs.Length} sinks"
         };
     }
 }
-
-/// <summary>
-/// Context for scan operations.
-/// </summary>
-public record ScanContext(
-    string ScanId,
-    string GraphHash,
-    string BuildId,
-    string ImageDigest,
-    string PolicyId,
-    string PolicyDigest,
-    string ScannerVersion,
-    string? ConfigPath = null,
-    ResolverOptions? ResolverOptions = null
-);
-
-/// <summary>
-/// Vulnerability match from scan.
-/// </summary>
-public record VulnerabilityMatch(
-    string VulnId,
-    string ComponentRef,
-    bool IsReachable,
-    string Severity
-);
-
-/// <summary>
-/// Result of PoE generation.
-/// </summary>
-public record PoEResult(
-    string VulnId,
-    string ComponentRef,
-    string PoeHash,
-    byte[] PoEBytes,
-    byte[] DsseBytes,
-    int NodeCount,
-    int EdgeCount
-);

src/Scanner/StellaOps.Scanner.Worker/Processing/PoE/PoEGenerationStageExecutor.cs

@@ -145,7 +145,7 @@ public sealed class PoEGenerationStageExecutor : IScanStageExecutor
 
         // Try to get graph hash from reachability analysis
         string? graphHash = null;
-        if (context.Analysis.TryGet(ScanAnalysisKeys.ReachabilityRichGraphCas, out var richGraphCas) && richGraphCas is RichGraphCasResult casResult)
+        if (context.Analysis.TryGet<RichGraphCasResult>(ScanAnalysisKeys.ReachabilityRichGraphCas, out var richGraphCas) && richGraphCas is RichGraphCasResult casResult)
         {
             graphHash = casResult.GraphHash;
         }