Link-Not-Merge v1 Fixtures

Verified against commit 942a18727c (2026-09-26). Re-verify with: sha256sum -c SHA256SUMS (run from the repository root) and grep -n 'lnm-v1\|FindFixture' src/SbomService/StellaOps.SbomService/Program.cs

These files are read by the SbomService local harness only (Development/Testing with SbomService:LocalHarness:Enabled=true, or the DevelopmentLocalHarness/TestingLocalHarness environment). A durable host never reads them. The host finds them by walking up from its content root to docs/modules/sbom-service/fixtures/lnm-v1/, unless the explicit paths SbomService:ProjectionsPath, SbomService:CatalogPath, or SbomService:ComponentLookupPath are set.

Contents (JSON, UTF-8):

• projections.json - SBOM projection payloads keyed by snapshot ID, served by GET /sboms/{snapshotId}/projection (see …/…/api/projection-read.md).
• catalog.json - rows for FileCatalogRepository (tenant SBOM catalog).
• component_lookup.json - rows for FileComponentLookupRepository (component lookup).
• SHA256SUMS - checksums for the three files above.

Tenant ownership (SPRINT_20260712_007):

• catalog.json and component_lookup.json rows MUST carry a tenantId. The local-harness repositories filter on the authenticated tenant exactly like the durable PostgreSQL repositories, so a row without a tenantId is owned by nobody and is returned to nobody - the same fail-closed rule migration 006 applies to legacy PostgreSQL rows.
• The rows here are owned by tenant-a, the tenant the SbomService test harness authenticates as.

Changing a fixture:

• Keep ordering stable and regenerate SHA256SUMS from the repository root: sha256sum docs/modules/sbom-service/fixtures/lnm-v1/*.json > docs/modules/sbom-service/fixtures/lnm-v1/SHA256SUMS.
• Tests that read these files: ProjectionEndpointTests and SbomTenantScopedReadModelTests in src/SbomService/StellaOps.SbomService.Tests/.