feat(skills): add stored SBOM maker

[tzwkb]

Summary

• add sbom-maker, a governed graph that reads an immutable public npm lockfile, emits a grounded CycloneDX SBOM and license findings, and appends it to a project-version data stream
• read the stored event back before exposing typed outputs, including the concrete event ref and provider evidence
• include deterministic local/SQLite adapters so registry installs and hosted harnesses do not rely on private tool catalogs

Verification

• node --test skills/sbom-maker/sbom-maker.test.mjs (13 passed)
• runx harness ./skills/sbom-maker (2/2 passed: one sealed, one refused)
• real source dogfood against microsoft/vscode-extension-samples/lsp-sample/server/package-lock.json at commit 3d8442b16c7f353779e266f16295703b2b4a6dcc
• real run committed and read back software_boms:lsp-sample-server@1.0.0:1 through data.sqlite