feat: bind release SBOM to exact artifacts

[VincentAdamNemessisX]

Summary

• replace the wall-clock/fixed-version SBOM generator with deterministic CycloneDX 1.5 generation bound to a clean exact Git source ref
• require the seven locally buildable core artifact kinds, exact file SHA-256, package identity, and an Android-primary Hub receipt
• model Cargo.lock as an aggregate evidence component instead of claiming an unproven per-binary dependency closure
• allowlist optional macOS/Windows distribution artifacts so every artifact present in a final release identity is uniquely hashed; reject unknown, missing, duplicate, dirty, or tampered inputs
• preserve the legacy generate-sbom.py OUTPUT entry point while adding explicit generate/verify commands and CI coverage

Passed locally (exact HEAD 7dca5ea4a1e7197d734976e696967d9930d5c535)

• focused SBOM contract: 15 passed
• repository Python tests: 28 passed
• Rust workspace: 303 passed, 5 ignored; fmt/clippy passed
• macOS Save Sync: 17 Swift tests; release build passed
• MH3G Save Converter macOS: 64 Swift tests; release build passed
• Android: testDebugUnitTest lintDebug assembleDebug — 55 tasks, BUILD SUCCESSFUL
• artifact-bound release SBOM regenerated from the exact clean HEAD and compared byte-for-byte with the recorded BOM/receipt; canonical release verifier passed
• official CycloneDX 1.5 JSON schema SHA-256 067f7824b08653839ea050ae9e09ca48375eadc2652b0e2a299476e7db90335b: check-jsonschema passed
• local ad-hoc Save Sync macOS ZIP and local non-GUI converter macOS ZIP were unpacked and verified for plist identity, executable files/modes, byte hashes, bundled CLI --help, and codesign --verify --deep --strict
• git diff --check passed; tracked and staged trees are clean

Hosted exact-head gates

• PR CI run 31142590094: rust, macos-smoke, compose-e2e, and Android jobs succeeded; dependency-review was an intentional optional skip
• macOS packaging dispatch 31142631631: succeeded on exact head
• Windows validation dispatch 31142633487: succeeded on exact head
• non-publishing release packaging dispatch 31143220686: source validation, macOS package, and Windows package jobs succeeded on exact head; publish job was skipped because the ref was not a tag

Exact-head artifact identity

• source ref: 7dca5ea4a1e7197d734976e696967d9930d5c535
• release identity SHA-256: da9544bc63bcecd5fadbd842fefe336cc09f22f5312f9de1cae924bb3efdaa46
• release SBOM SHA-256: 40e582f705203864239a74ec5d44c07906c686af31a28eaa36c7e61ff8d22970
• SBOM identity receipt SHA-256: 1477516d47161dadc0d7a28caf874d964dd70034be1cbba6d6e12b56788d5417
• primary Android APK SHA-256: fa530b6fa2c934ea623bf274513ab2915569d43f68d7085312c529a7e1e39f2b (org.mhtoolkit.savesync, 0.1.0-alpha.4, code 5)
• Rust CLI: e94898d18e9e80cdcddd4ef8921b34c3af11ff2fda3ba4d14599b1070b1f6486
• Rust server: 78d660226f49d8959ece51d9b3eaa5acbf97ffd578b375ff327ee503368e6eb5
• MH3G converter CLI: c6b5934cb79cdd63cc7ea7264491b3e3f2bbb5b781bdea254d3dd14beff2cac4
• macOS Save Sync executable: 1ee358180ae2feaf434602939c423231a491996656c29c81704b15beb2b8a373
• macOS converter executable: 592fecc1fbec89702a5fc1711bff808272bf44bd31686c33859fd0619a6b09d3
• Save Sync macOS local ad-hoc ZIP: 08f6c57e73c9c778a41f62f3b75c736286cbc48e5b879e05e35f0b40a775332a
• converter macOS local non-GUI ZIP: 5c822f72b3dd577194410b295b3e21885c66f103529b6213d249814391b8c4e2

Current evidence is outside the repository at /Volumes/GameHub/Development/Games/.release-lock-builds/mh-save-sync-sbom-7dca5ea/. The former 9c5b0c1 evidence and hashes are superseded and must not be used for alpha.9.

Unverified / final-lock boundary

• Windows ZIP/portable/setup files from the exact-head Hosted package run were not incorporated into this local BOM in this PR checkpoint; their final locked distribution identity remains Unverified and must be regenerated and bound from the exact merged ref
• the final alpha.9 merged-ref release identity must rebuild and verify every actual locked distribution artifact; open-PR or pre-merge identities are not final release evidence
• real Windows WinUI interaction, real-save full transactions, Cemu/Nemessix continue-play, CEC, guild-card, and companion runtime remain Unverified
• the Windows main UI still exposes the CLI selector; moving it to advanced settings remains follow-up Owner work
• the accepted macOS archive evidence is non-GUI plist/hash/executable/codesign/CLI verification; no new window smoke was run during the work-time GUI boundary
• no QQ, ADB, install, production app/configuration, or user save state was touched