add SBOM generation to CI, document in governance

.github/workflows/release.yml

@@ -68,6 +68,10 @@ jobs:
           tar -czf builds/notalterra-${GITHUB_REF_NAME}-linux-amd64.tar.gz notalterra
           cp target/x86_64-pc-windows-gnu/release/notalterra.exe NotAlterra.exe
           zip -q builds/notalterra-${GITHUB_REF_NAME}-windows-x64.zip NotAlterra.exe
+      - name: Generate SBOM
+        run: |
+          cargo cyclonedx --all --output-dir builds
+          mv builds/notalterra-*.cdx.json builds/notalterra-${GITHUB_REF_NAME}-sbom.cdx.json 2>/dev/null || true
       - name: Generate hashes
         id: hash
         run: |

docs/GOVERNANCE.md

@@ -83,6 +83,10 @@ not published. The maintainer tests the draft binaries before publishing.
 
 > CodeQL static analysis is enabled on every push and pull request.
 > Alerts are reviewed before release. Currently zero open alerts.
+>
+> An SBOM (CycloneDX JSON) is generated during every tagged release
+> and included alongside the binaries. It lists every crate in the
+> dependency tree, versions, and licenses.
 
 Before signing a release tag, the maintainer verifies: