build(cyberbattlesim): author the RAES scenario and pinned source mapping ledger

[Brad-Edwards]

Summary

Authors the portable RAES evidence set for the qualified (but not-admissible) CyberBattleSim CyberBattleChain-v0 case: an authored RAES SDL scenario carrying topology/objective truth, companion published experiment contracts for the reward/evaluator/metric/episode-termination/stochastic intent RAES excludes from SDL, and a pinned source→RAES mapping ledger with loss disclosures. All portable surfaces consume raes==2.0.0 published contracts; deterministic tests fail closed on drift, missing coverage, broken cross-artifact joins, undisclosed loss, or native leakage. The not-admissible decision and the unpublished cyberbattlesim extra are unchanged.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #26

ADR Impact

• ADR-021
• ADR-002
• ADR-003

Changes

• Add the RAES SDL scenario scenario/cyberbattle-chain.sdl.yaml (chain topology, vulnerabilities, synthetic credential intent, attacker/defender agents, ownership + availability objectives, actions, observations, evidence requirements); it parses, instantiates, compiles (raes_processor), and admits with a pinned canonical digest
• Add companion published experiment contracts experiment/cyberbattle-chain.{task,spec}.exp.yaml (evaluation protocol + 4 metrics; run plan with episode/termination control and four descriptive stochastic controls with no executable binding, retaining the determinism loss)
• Add the pinned source→RAES mapping ledger mapping/source-ledger.jsonl (29 rows over 11 required categories; each row mapped/excluded/loss-disclosed) plus mapping/loss-disclosures.md bound to ADR-069 equivalence tiers and mapping/README.md
• Add scenario_ledger.py: an immutable EvidenceSelection descriptor (extension seam), loaders, and deterministic validators — SDL pipeline, source-drift digest joins to qualification.json, target resolution via schema_bundle(), cross-artifact reference joins, provenance-grounded native-leakage scan
• Add tests/test_cyberbattlesim_scenario_ledger.py with positive checks and fail-closed negatives for every enforced condition
• Wire the preflight scenario/ledger guardrails note into the docs nav and document the evidence set in the README

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

make verify green (hygiene, policy, lint, tool-tests, mypy strict, pytest over base + each extra with coverage ≥80%, wheel/sdist build + clean-install, strict docs). 46 tests in the new suite; module coverage 91%. Both pre-push AI reviewers (Codex, test-quality) clean after fixes.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: ADR-021 ← src/raes_adapters/cyberbattlesim/scenario_ledger.py, ADR-002 ← src/raes_adapters/cyberbattlesim/scenario/cyberbattle-chain.sdl.yaml, ADR-002 ← src/raes_adapters/cyberbattlesim/experiment/cyberbattle-chain.task.exp.yaml, ADR-002 ← src/raes_adapters/cyberbattlesim/mapping/source-ledger.jsonl
• TESTS: ADR-021 ← tests/test_cyberbattlesim_scenario_ledger.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed