docs: VCS detection everywhere, and /workspace is the mount

[vpetersson-bot]

Catches the /sbomify-action/ docs up with the CI runtime platform layer (sbomify-action#401) and the audit trail path change (#400).

What was wrong

VCS detection is no longer a GitHub/GitLab/Bitbucket/TeamCity feature. Platforms that publish no repository variables now read the git checkout, so Jenkins, CircleCI, Azure Pipelines and any other container runner get provenance with no configuration. All four pages told people to hand-write vcs_url into sbomify.json. A local run is the exception: it reads the checkout only under the new SBOMIFY_LOCAL_VCS=true, which we did not document at all.

The image gained WORKDIR /workspace, so every docker run example loses its -w. The old -v "$PWD:/github/workspace" -w /github/workspace still resolves and the generic runner page says so, along with the trap that comes with it: outputs are written relative to the working directory, so a mount without a matching -w leaves the SBOM inside the container.

TeamCity's -w /github/workspace was wrong before this branch and is gone from all four places it appeared. The Docker Wrapper mounts the checkout and runs the script inside it; overriding -w pointed the run at a directory that is not the checkout — which the same page contradicted two paragraphs later.

Also corrected: Bitbucket Data Center gets no guessed commit URL, the wizard refuses on any recognised CI platform rather than $CI and $GITHUB_ACTIONS alone, WORKING_DIR confinement is GitHub Actions only, and audit trail paths are recorded relative to the working directory.

Files

• augmentation.md — rewrote Automatic VCS detection: source table, the two preconditions for checkout-based detection, SBOMIFY_LOCAL_VCS, commit-URL coverage
• _index.md, runtimes/_index.md — matrices (Manual → From git, local → Opt-in), universal pattern mounts /workspace
• runtimes/{jenkins,circleci,azure-devops,local,docker,bitbucket}.md — VCS sections and the frontmatter tldrs that promised manual config; new VCS section on the generic Docker page covering the CI/vendor-variable requirement
• runtimes/teamcity.md — dropped the stale -w
• configuration.md — SBOMIFY_LOCAL_VCS, DISABLE_VCS_AUGMENTATION, WORKING_DIR, generic CI vendor/checkout variables
• quickstart.md, advanced.md, github-actions.md, how-it-works.md — mount paths, wizard CI note, audit-trail path note

bun run lint passes and hugo --minify --environment production builds clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KpQTA8RTVfX4wm5is4S4MQ