Replace custom SBOM generation with CycloneDX or Syft workflow

[mark-e-deyoung]

Summary

Replace or wrap WineBot's custom SBOM generation path with widely used SBOM tooling.

Candidate tools

• CycloneDX Python tooling (cyclonedx-py) for Python dependency SBOMs
• Anchore Syft for filesystem/container image SBOMs
• Keep WineBot's license/release policy validation as thin checks over standard SBOM output

Acceptance criteria

• CI produces standards-compliant CycloneDX or SPDX SBOM artifacts using established tooling.
• Existing license policy checks continue to pass against the generated artifact.
• Runtime/dev/test dependency roots remain explicit so unrelated host packages are not included.
• Build/deployment docs identify the required SBOM tooling and versions.

Recommendation

Implement after the current release gate, or sooner if SBOM trust is release-blocking.

Trade-offs

Standard tools reduce maintenance and improve interoperability. A thin WineBot-specific policy layer may still be needed for project-specific release rules.