Release: bundle SBOM assets

[Alex9001]

Summary

• validate every generated CLI, package, and GUI SBOM before publishing
• consolidate the individual JSON documents into one versioned ZIP with cli/ and gui/ directories
• remove the individual SBOM JSON files from the public asset set and replace their checksum entries with the bundle checksum
• exercise the same bundling path in ordinary CI and document the cleaner release layout

Validation

• bundled all 23 SBOMs downloaded from v2.5.2
• verified every source JSON before bundling
• verified ZIP integrity, contents, removal of individual files, and the rewritten SHA-256 checksum
• shell syntax, workflow YAML, actionlint, and Go tests pass locally