feat: define the current OpenAdapt platform BOM

[abrichr]

Outcome

This replaces #1072 with the same useful platform bill-of-materials mechanism on the exact current #1096 design at c4a4f2eb. It does not carry the old Flow 1.26 or Desktop release assumptions.

• generate one versioned BOM from current PyPI metadata, exact GitHub release refs, immutable artifact hashes, published dependency metadata, the exact Desktop sidecar lock, released schema sources, public qualification evidence, and the live status contract
• record the launcher, customer runner, Desktop sidecar, and Agent bridge runtime units plus every selected-component dependency edge
• compute compatibility from the selected releases and fail closed when promotion requires an incompatible set
• validate structure, artifact sets, URLs, SHA-256 digests, dependency ranges, release commits and trees, schema source hashes, evidence objects, the Desktop lock, status drift, and honest unsigned-signature state
• provide exact published-version inputs for an ordered release train without inventing future versions
• generate the human-readable compatibility report and version display from the machine-readable BOM
• run the low-cost offline check first, then the live drift check, focused contract tests, and the source-boundary guard
• make launcher release reconciliation check and commit both generated BOM files

Current generated selection

• Launcher 1.12.1
• Flow 1.31.0
• Capture 1.2.2
• Privacy 1.0.2
• Types 0.10.0
• Desktop 0.15.0
• Agent 2.0.1

The selected dependency graph is compatible. Human Decision v2, the released decision relay, and Runtime Validation v3 come from their exact released schema sources. The manifest makes no installer-signing or production-acceptance claim.

Validation

• strict live validation with --require-network --strict-status --require-compatible: passed with zero warnings
• locked project suite: 174 passed, 6 platform skips
• focused BOM suite: 36 passed
• Ruff check and format: passed
• source-boundary guard: passed
• actionlint for both changed workflows: passed
• staged diff check: passed
• independent exact-diff review: no findings after one release-reconciliation defect was fixed and re-reviewed

Stack

This draft targets the exact #1096 branch so the review contains only the BOM replacement. Retarget it to main after #1096 merges. It fully supersedes #1072; that older branch remains preserved.