Add structured SBOM (Software Bill of Materials) generation #3
Description
Summary
Generate CycloneDX or SPDX SBOMs for every release, covering both the Go gateway binary and the Python service dependencies. This strengthens the compliance story and is increasingly required for enterprise adoption.
Acceptance Criteria
- SBOM generated automatically in CI on release tags
- Covers Go modules (gateway, OTel processors) and Python packages (SDK, Episode Store, Policy Engine)
- Published as release artifacts alongside binaries
Milestone
v0.2.0