build: an SPDX SBOM with every board image, and of the source tree, by syft

make boot_image now ends by writing build/boards/<board>/<image>.spdx(.json):
the image and every file copied off it, each with its SHA-256 -- the SBOM
of what is on the medium.  It also refreshes sbom.spdx(.json), the source
SBOM: the tracked files the product is built from (kernel, v3, v4,
capsules, boards, tooling, proofs), staged to build/sbom/src so nothing
untracked in the working directory is swept in.  Versioned as the kernel
version and git describe.  mk/syft.yaml turns on file cataloging with
SHA-256 (a C tree has almost no packages for syft to find: the old SBOM
held one file with a zero checksum).  No syft: the build stops.

syft 1.52.0 installed in ~/.local/bin from its GitHub release, checked
against the release's published SHA-256.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mk/syft.yaml

@@ -0,0 +1,9 @@
+# syft configuration for this repository's SBOMs (make sbom, make boot_image).
+# A C kernel has almost no "packages" for syft's catalogers to find, so the
+# SBOM's substance is the file list: every file in scope, with its SHA-256
+# (2026-10-14; until then the SBOM held one file, with a zero checksum).
+file:
+  metadata:
+    selection: all
+    digests:
+      - sha256