feat(preflight): add @cyclonedx/cdxgen to background downloads

Include cdxgen in preflight downloads alongside coana and cli-ai to
ensure it's cached on first CLI run for faster manifest generation.

Author: jdalton

packages/cli/src/utils/preflight/downloads.mts

@@ -1,8 +1,8 @@
 /**
  * Background preflight downloads for optional dependencies.
  *
- * Silently downloads @coana-tech/cli and @socketbin/cli-ai in the background
- * on first CLI run to ensure they're cached for future use.
+ * Silently downloads @coana-tech/cli, @cyclonedx/cdxgen, and @socketbin/cli-ai
+ * in the background on first CLI run to ensure they're cached for future use.
  *
  * This runs asynchronously and never blocks the main CLI execution.
  */
@@ -54,6 +54,15 @@ export function runPreflightDownloads(): void {
       }
     }
 
+    // @cyclonedx/cdxgen preflight.
+    const cdxgenVersion = ENV.INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION
+    if (cdxgenVersion) {
+      const cdxgenSpec = `@cyclonedx/cdxgen@~${cdxgenVersion}`
+      if (!isPackageCached(cdxgenSpec)) {
+        downloads.push({ packageSpec: cdxgenSpec, binaryName: 'cdxgen' })
+      }
+    }
+
     // @socketbin/cli-ai preflight.
     const cliAiVersion = ENV.INLINED_SOCKET_CLI_AI_VERSION
     if (cliAiVersion) {