feat(core): bind release SBOM to manifest artifacts

[seonghobae]

Scope

Bounded partial implementation of #201, stacked on PR #219. This Draft binds one SPDX 3.0.1 JSON-LD SBOM artifact to the exact immutable release-manifest identity, binds candidate bytes to that manifest-backed SBOM SHA-256, and applies a bounded fail-closed JSON-LD envelope/file-admission verifier.

It does not generate an SBOM, certify full SPDX conformance, authenticate the producer, establish provenance, sign or publish a release, or grant install, update, or rollback authority.

Integrity contract

ReleaseSbomBinding retains the complete bounded ReleaseManifest, exact manifest-backed SBOM artifact, and exact described ReleaseArtifact identities. Missing, duplicate, case-drifted, foreign, self-described, or incomplete described-artifact inventories fail closed.

ReleaseSbomFormat::Spdx30JsonLd exposes SPDX version 3.0.1 and the pinned global context https://spdx.org/rdf/3.0.1/spdx-context.jsonld. The verifier separately admits only strict UTF-8 JSON-LD with bounded numeric lexemes, exact top-level context/graph shape, bounded graph cardinality, object-only graph entries, and exactly one SpdxDocument. Local file admission remains direct-path, regular-file, descriptor-relative, no-follow, nonblocking, and identity-bound before, during, and after the bounded read.

Diagnostics do not reflect document-controlled values, expected digest values, or candidate filesystem paths. This is metadata correspondence evidence, not producer authentication or release authority.

Exact current stack state

• exact base: feat/release-manifest-artifact-contract@94d5e1f12c959243d107c6f7bfff24faf995d633;
• exact head: feat/release-spdx-sbom-binding@f0237159d37155da4a9b637ee860f7a06a7a8b1e;
• parent PR feat(core): bind release artifacts to canonical manifest identity #219 is the current Ready branch at the exact base above; and
• this PR remains Draft while the parent stack is active.

Exact-head evidence

On exact head f0237159d37155da4a9b637ee860f7a06a7a8b1e:

• Rust contracts job 98820664533: success;
• Production coverage job 98820664274: success, with production functions, lines, regions, and branches at 100%;
• Pinned Chrome for Testing MV3 fixture job 98820663543: success;
• no current inline review threads are present; and
• no formal approval evidence is claimed for this Draft.

Previous-head and parent-head evidence is not transferred. The parent owns ADR 0016 for BAP task lifecycle authority; this child uses proposed ADR 0018 for the SBOM design and does not promote it to Accepted or protected-main truth.

Authority boundary

Digest equality proves correspondence to the manifest-declared artifact identity only. This preliminary verifier does not authenticate the producer, validate complete SPDX semantics, prove provenance or reproducibility, or grant signing, publication, installation, update, rollback, or release authority.

Protected-main AGENTS.md remains authoritative; this scheduled writer does not merge, self-approve, force-push, alter workflows/rulesets/secrets, tag, release, or publish.