[WM-IMP-1] No SBOM — Software Bill of Materials not generated or published

## WM-IMP-1 — No Software Bill of Materials (SBOM)

**Category:** Improvement | **Priority:** High

### Observation
No SBOM is generated or published for any component of the system. EO 14028 and FedRAMP require SBOMs for federal software supply chain transparency.

### Evidence
- Issue #636 — no SBOM noted as critical finding (C3)

### Recommendation
Generate and publish a CycloneDX or SPDX SBOM as part of the CI/CD pipeline.

### Acceptance Criteria
- [ ] SBOM generated in CycloneDX or SPDX format on every release
- [ ] SBOM published as a release artifact
- [ ] SBOM includes all direct and transitive dependencies with license and version data
- [ ] CI pipeline fails if SBOM generation fails