Add exact-image CycloneDX SBOM evidence

[RicheyWorks]

Outcome

• generate a CycloneDX SBOM from the exact locally built CI dry-run image
• validate populated CycloneDX structure and a strict SHA-256 checksum
• bind the SBOM checksum to the immutable local Docker image ID, source commit SHA, and workflow SHA
• retain the evidence in the existing no-publish/no-sign artifact

Safety boundary

• no registry login or image publication
• no container signing
• no release or tag creation
• no staging or external target
• the existing fixed high/critical Trivy scan remains the vulnerability gate

Verification

• bash -n scripts/smoke/validate-container-image-sbom.sh
• mvn -q -Dtest=DeploymentPackagingContractTest test
• mvn -q test (2,694 tests; 0 failures, 0 errors, 0 skipped)
• git diff --cached --check
• hosted Docker/Trivy integration and uploaded artifact inspection pending exact-head CI