Publish artifact-scoped SPDX inventories for releases

[Copilot]

Summary

• Add deterministic SPDX inventories for shipped CLI archives and MCPBs, scoped to each platform’s runtime components and embedded assets.
• Publish inventories with artifact digests, checksums, and attestations; preserve immutable recovery behavior.

Motivation

Release consumers need to identify the components in each distributed binary without mistaking development dependencies for shipped content.

Changes

• Inventory: Capture the configured Bazel runtime graph, production dashboard dependencies and assets, vendored sources, and NOTICE-attributed adaptations. Mark unknown metadata explicitly for review.
• Release and recovery: Generate inventories against final archive/MCPB bytes; publish them as detached assets and include them in checksum, attestation, and recovery flows.
• Signing documentation: Correct the Windows signing status; certificate and service provisioning remain external blockers.

Test plan

• The affected Bazel targets pass
• bazel build //... passes when the change crosses package boundaries
• Tested manually: focused release inventory and recovery checks; Bazel execution was unavailable in this environment.

Checklist

• CHANGELOG.md updated (under [Unreleased] if no version bump)
• No secrets, credentials, or .env files included
• Breaking changes documented (if any)

• Fixes release: attach an artifact-scoped component and license inventory to shipped distributions #4343

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7ae6d3b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR