feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2)

Upgrade the firmware SBOM from analysis-only to a full reproducible build: run
tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a
sealed lock whose libraries are pinned and whose firmware artifact carries a
content hash, then render the SBOM from the lock plus deep binary SCA of any
pre-compiled inputs — the complete bill of materials (toolchain + every fetched
library + the firmware image), mapped into `SbomEntry` rows.

Graceful by design: when no nix backend is available (or the build fails / times
out at 15m), it falls back to the analysis-only components (toolchain +
resolvable libraries), so a nix that can't run in the deployment never breaks a
scan.

Infra: the agent image now installs `nix-portable` (rootless, single binary;
best-effort — a failed download just leaves the analysis-only path). The nix
store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT
volume there in the deployment, otherwise every firmware scan re-fetches
nixpkgs + cross toolchains.

Adds the `tramiton-sbom` dependency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Cargo.lock

@@ -694,6 +694,7 @@ dependencies = [
  "tracing-subscriber",
  "tramiton-core",
  "tramiton-repro",
+ "tramiton-sbom",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -2102,7 +2103,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3768,6 +3769,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "octocrab"
 version = "0.44.1"
@@ -4682,7 +4692,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5560,10 +5570,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.1",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6164,6 +6174,19 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tramiton-sbom"
+version = "0.4.0"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
+dependencies = [
+ "object",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tramiton-core",
+ "tramiton-repro",
+]
+
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -6722,7 +6745,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]