feat(pipeline): analysis-based firmware SBOM from tramiton (#156)

compliance-agent/src/pipeline/orchestrator.rs

@@ -601,6 +601,47 @@ impl PipelineOrchestrator {
                 tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
             }
         }
+
+        // Analysis-based firmware SBOM: for embedded targets, derive components
+        // (resolved libraries + cross-toolchain) from tramiton's build-plan
+        // analysis over the already-ingested source — no build, no binary
+        // upload. Best-effort; empty when no build plan forms.
+        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
+            if let Some(code) = target.code_artifact() {
+                if let Some(path) = working_paths.get(&code.id) {
+                    let entries =
+                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
+                            .await;
+                    if !entries.is_empty() {
+                        let _ = self
+                            .db
+                            .sbom_entries()
+                            .delete_many(doc! { "repo_id": target_id })
+                            .await;
+                        for entry in &entries {
+                            let filter = doc! {
+                                "repo_id": &entry.repo_id,
+                                "name": &entry.name,
+                                "version": &entry.version,
+                            };
+                            if let Ok(d) = mongodb::bson::to_document(entry) {
+                                let _ = self
+                                    .db
+                                    .sbom_entries()
+                                    .update_one(filter, doc! { "$set": d })
+                                    .upsert(true)
+                                    .await;
+                            }
+                        }
+                        tracing::info!(
+                            target_id,
+                            count = entries.len(),
+                            "Firmware SBOM: stored components from tramiton analysis"
+                        );
+                    }
+                }
+            }
+        }
     }
 
     /// If the target has a `LiveUrl` artifact and DAST is planned, provision a