Add final production SBOM workflow

[alex-zaitsev]

Summary

• add a release-scoped SPDX 2.3 production SBOM workflow
• establish component version, supplier, PURL, license, architecture, evidence, and explicit final-binary inclusion
• reconcile DEB, RPM, TGZ, and multi-architecture OCI executable hashes
• preserve release-build, source-pin, and embedded-license evidence
• fail closed when artifact identity or required metadata cannot be established

Motivation

The existing VDR SBOMs do not establish whether each component is present in the final shipped binary. This workflow produces an immutable-digest-scoped SBOM suitable for Stable Build, BYOC, and on-prem compliance review.

Validation

• unit tests pass
• Python and workflow syntax validated
• DEB, RPM, and TGZ streaming extraction tested against release 26.6.2
• generator reproduced 1,322 component records from the verified 26.6.2 evidence fixture
• generated SPDX passed SPDX 2.3 validation
• component metadata, relationship, package-digest, and ZIP-integrity gates passed

Operational impact

• uses only contents: read and actions: read
• requires no new repository secrets
• runs manually or when a release is published
• full runs download release packages and both OCI architectures and may take significant runner time and storage

Scope

A generated SBOM is final only for the immutable package, image, and executable digests in its channel manifest.

[github-actions]

Workflow [PR], commit [f869b55]