feat(sbom): version input and policy contracts

[stacknil]

Summary

• document the real CycloneDX, SPDX, requirements, and pyproject parser subsets
• add explicit policy/report schema identifiers with v1.0 policy compatibility
• emit matched rule, exact evidence, decision reason, and confidence on policy findings
• add report schema compatibility coverage across local, provenance, and Scorecard fixtures
• fix the v1.1 component identity route while keeping the tool in the monorepo

Validation

• python -m pytest (200 passed)
• python scripts/regenerate-example-artifacts.py --check
• python scripts/validate-reviewer-routes.py
• git diff --check

Boundaries

• no repository split
• no production PyPI publication
• component identity diagnostics remain the next implementation slice