build(stub+go.mod): unblock kubescape#808 standalone build

Three matthyx blockers (2026-05-27):

(1) tamper_alert.go:28 — imports pkg/signature and pkg/signature/profiles
which ship in node-agent#809 (not yet merged). Adds minimum-surface
stubs (pkg/signature/stub.go, pkg/signature/profiles/stub.go) so the
PR compiles standalone. With IsSigned returning false, the tamper path
short-circuits and never invokes Verify — the no-op stub is behavior-
safe: signed-profile detection is dormant until kubescape#809 lands and replaces
these files with the real implementation.

(2) projection_apply.go:265 — NetworkNeighbor.IPAddresses missing.
(3) mock.go:202 — same IPAddresses issue.

Both (2) and (3) resolved by replacing kubescape/storage with
k8sstormcenter/storage's upstream-pr/sbob-network tip 46f37d32 (sibling
of kubescape/storage#324). Removed when kubescape#324 merges and a release ships
IPAddresses.

Author: Entlein

go.mod

@@ -470,3 +470,5 @@ replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspe
 replace github.com/cilium/ebpf => github.com/matthyx/ebpf v0.0.0-20260421101317-8a32d06def6c
 
 replace github.com/anchore/syft => github.com/kubescape/syft v1.32.0-ks.2
+
+replace github.com/kubescape/storage => github.com/k8sstormcenter/storage v0.0.240-0.20260527173728-46f37d32b969

go.sum

@@ -853,6 +853,8 @@ github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHm
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/k8sstormcenter/storage v0.0.240-0.20260527173728-46f37d32b969 h1:ZEifelzzPQ/n6D9p/znxd18GadIajfwxANrJQDtpx34=
+github.com/k8sstormcenter/storage v0.0.240-0.20260527173728-46f37d32b969/go.mod h1:FpV6tCrYXlp2kKWza4yr7zf2Y1q7IGgx871ndN7SMNo=
 github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953 h1:WdAeg/imY2JFPc/9CST4bZ80nNJbiBFCAdSZCSgrS5Y=
 github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953/go.mod h1:6o+UrvuZWc4UTyBhQf0LGjW9Ld7qJxLz/OqvSOWWlEc=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=

pkg/signature/profiles/stub.go

@@ -0,0 +1,18 @@
+// Package profiles is a build-time stub of the full profile-adapter
+// package landing in kubescape/node-agent#809. Returns nil adapters —
+// upstream IsSigned short-circuits and the tamper path is dormant
+// until #809 lands and replaces this file.
+package profiles
+
+import (
+	"github.com/kubescape/node-agent/pkg/signature"
+	"github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1"
+)
+
+func NewApplicationProfileAdapter(_ *v1beta1.ApplicationProfile) signature.Signable {
+	return nil
+}
+
+func NewNetworkNeighborhoodAdapter(_ *v1beta1.NetworkNeighborhood) signature.Signable {
+	return nil
+}

pkg/signature/stub.go

@@ -0,0 +1,27 @@
+// Package signature is a build-time stub of the full signature package
+// landing in kubescape/node-agent#809. Exposes the minimum surface the
+// tamper-detection path in this PR (#808) imports — IsSigned,
+// VerifyObjectAllowUntrusted, SignObjectDisableKeyless, and the
+// ErrSignatureMismatch sentinel — so the PR compiles standalone.
+//
+// All operations no-op: IsSigned returns false (tamper path treats
+// every profile as unsigned and skips verification), Verify and Sign
+// return nil. Replace with the real implementation from #809 when that
+// PR lands; this file is intended to be deleted, not maintained.
+package signature
+
+import "errors"
+
+// ErrSignatureMismatch is the sentinel the tamper-detection path
+// errors.Is-checks. Must remain non-nil with this exact message —
+// tamper_alert_test.go pins both invariants.
+var ErrSignatureMismatch = errors.New("signature verification failed")
+
+// Signable is the marker interface adapters in pkg/signature/profiles
+// satisfy. Empty in the stub; the real package decorates it with
+// signature-payload accessors.
+type Signable interface{}
+
+func IsSigned(_ Signable) bool                    { return false }
+func VerifyObjectAllowUntrusted(_ Signable) error { return nil }
+func SignObjectDisableKeyless(_ Signable) error   { return nil }