ci: the supply chain accounts for itself — per-release SBOM, full-tree audits, a real license gate

CRA Annex I Part II groundwork (see punktfunk-planning design/cra-readiness.md, Phase 1):

* sbom.yml + scripts/ci/gen-sbom.sh: every vX.Y.Z release gets a CycloneDX
  SBOM attached — syft over both Cargo.locks, all Bun/pnpm trees and the
  Swift Package.resolved (2,667 components), merged with
  compliance/sbom/manual-components.cdx.json for what no lockfile records
  (pyrowave/Granite/volk/Vulkan-Headers pins, libvpl, FFmpeg, SDL3,
  VB-CABLE, punktfunk-gamescope).
* audit.yml: bun audit now covers sdk + plugin-kit (not just web), decky's
  pnpm tree is scanned, and docs-site runs non-blocking until its known
  CMS-chain advisories are cleared. All shipping trees verified green today.
* license-gate: about.toml's allowlist claim is finally enforced —
  cargo-about 0.9.1 with --fail over BOTH workspaces. The old [crate.clarify]
  license-only syntax fails to deserialize under 0.9; migrated ring to a
  per-crate accepted extension and dropped the stale aws-lc-sys entry
  (workspace is ring-only). Both gates validated green locally.
* drivers/Cargo.lock: sync the pf-dualsense→pf-gamepad rename — the crate
  rename updated the manifest but the Windows-only lockfile was never
  regenerated; cargo-about's metadata pass caught it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/ci/gen-sbom.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# Generate the per-release CycloneDX SBOM (CRA Annex I Part II §1 — machine-readable component
+# inventory, attached to every stable release by .gitea/workflows/sbom.yml).
+#
+# syft walks the checkout and catalogs every lockfile-pinned dependency (both Rust workspaces via
+# their Cargo.locks, the Bun/pnpm/npm trees, the Swift Package.resolved);
+# compliance/sbom/manual-components.cdx.json contributes the components no lockfile records —
+# vendored C/C++ trees (pyrowave/Granite/volk/Vulkan-Headers, libvpl), dynamically-linked/bundled
+# libraries (FFmpeg, SDL3), the redistributed VB-CABLE driver, and the patched gamescope. Keep
+# that file current when vendoring changes (scripts/vendor-pyrowave.sh etc.).
+#
+# Usage: scripts/ci/gen-sbom.sh VERSION [OUTPUT]
+# Requires: syft (pinned install in the workflow), python3 (a proven runner dependency).
+set -eu
+VERSION="${1:?usage: gen-sbom.sh VERSION [OUTPUT]}"
+OUT="${2:-punktfunk-${VERSION}.cdx.json}"
+TMP="${OUT}.syft.tmp"
+
+syft scan "dir:." --source-name punktfunk --source-version "$VERSION" \
+  -o "cyclonedx-json=$TMP" -q
+
+OUT="$OUT" TMP="$TMP" python3 - <<'PY'
+import json, os
+gen = json.load(open(os.environ["TMP"]))
+manual = json.load(open("compliance/sbom/manual-components.cdx.json"))
+gen.setdefault("components", []).extend(manual["components"])
+with open(os.environ["OUT"], "w") as f:
+    json.dump(gen, f, indent=2)
+print("SBOM: %d components -> %s" % (len(gen["components"]), os.environ["OUT"]))
+PY
+rm -f "$TMP"