docs: complete SBOM dependency inventory

[zefutoff]

Summary

• mark the Phase 5 SBOM / dependency inventory work as complete

Validation

The CycloneDX runtime SBOM implementation has now been exercised successfully
on main.

Validated commit:

2d8e7c80c90eeb8fef10f98f51a86f59290dca0c

Successful CI run:

37988498005

Successful signed-release run:

37988751585

Both completed successfully.

Release artifact verification

The real grammalecte-android-signed-release artifact was inspected after the
successful workflow run.

It contains exactly:

app/build/outputs/apk/release/app-release-signed.apk
app/build/outputs/apk/release/app-release-signed.apk.sha256
build/reports/sbom/grammalecte-android.cdx.json
build/reports/sbom/grammalecte-android.cdx.json.sha256

Both checksum files successfully verify their corresponding artifacts.

SBOM verification

The release SBOM reports:

CycloneDX 1.6
13 components

It contains the vendored Grammalecte component:

Grammalecte 2.3.0
pkg:github/algoo/grammalecte@47af2080202e647110e5199ebd5d4b51d2bd51db

The SBOM therefore covers both Gradle-resolved runtime dependencies and the
vendored Grammalecte engine that is not visible to Gradle dependency
resolution.

Roadmap

Completes:

Phase 5 — SBOM / dependency inventory

The next Phase 5 item is:

F-Droid metadata and reproducibility checks