Complete container dependency inventories in v0.1.3

[tiammomo]

Container SPDX files in v0.1.2 contained OS packages but omitted the compiled Rust and bundled npm dependencies. Runtime images now retain the build lockfiles under /usr/share/modelport/sbom/, outside the dashboard web root. The pinned Syft scanner explicitly enables Cargo/npm lockfile catalogers in addition to its default image catalogers.

Require the expected application package ecosystem before signing the container SBOM and completing release publication. The inventory records locked build inputs and can include workspace/build dependencies; it does not claim runtime reachability. Prepare v0.1.3 without rewriting the immutable v0.1.2 assets or tag.

Validation:

• Built metadata-only layers on all three actual v0.1.2 runtime images and scanned them with pinned Syft 1.51.1: 362 Cargo entries for each Rust image and 115 npm entries for the dashboard.
• Executed the exact workflow gate against all three corrected inventories and all three published v0.1.2 inventories: new evidence accepted, old incomplete evidence rejected.
• Verified dashboard lockfiles exist outside the served web root.
• Actionlint with ShellCheck, documentation links, both Compose manifests and whitespace checks passed.
• Required CI will validate the version update; the release workflow will build and inspect the final v0.1.3 images before publication.