Native Cosmos driver: SBOM, provenance & checksums (supply-chain integrity)

Part of the **Cosmos DB Go SDK v2 (`azcosmos/v2`)** effort. The Go v2 SDK ships a native artifact built from the Rust driver; consumers must be able to trust what went into it and that it hasn't been modified. Self-contained; owners decide how to complete it.

**Scope**
- **SBOM** — generate a Software Bill of Materials from `Cargo.lock` for each release.
- **Provenance** — attest who built this version, from what source, and how, so the build can be trusted.
- **Checksums** — publish SHA256 hashes out of the trusted build so a consumer can verify "if it hashes to this, it came from this build."
- **Auditable binaries** — embed dependency info via [`cargo-auditable`](https://github.com/rust-secure-code/cargo-auditable).
- **Dependency policy** — obtain the exception needed for the cgo/native dependency; define CVE-response ownership spanning the Rust and native-driver repos.

**Deliverables**
- SBOM + provenance attestation + published checksums per release.
- Auditable binaries.
- Approved dependency-policy exception.
- A short doc explaining how each of SBOM / provenance / signing is addressed (signing itself is tracked in the sibling issue).

**Definition of done**
- Each release ships an SBOM, provenance, and checksums; binaries are auditable; the dependency-policy exception is approved.

Start by reviewing the Cosmos DB Go SDK v2 release flow and the Rust driver's Cargo.lock, then assess how cargo-auditable applies to the native binaries. Define how each release will produce and publish the SBOM, provenance attestation, and SHA256 checksums, and document the dependency-policy exception and CVE-response ownership; done means all listed release artifacts and approvals exist.

Written by the indexing model from the issue text.