fix(ci): sbom job never installed @modelforge/contracts's own dependencies

Root-caused from the real CI log (npm ls --all failing with
ELSPROBLEMS: missing typescript/zod required by
contracts@npm:@modelforge/contracts, plus a handful of extraneous
@emnapi/@napi-rs/@tybys packages as a downstream symptom) and
reproduced exactly, byte for byte, locally: frontend/ and app/ both
depend on packages/contracts via file:../packages/contracts, which
npm ci only symlinks into their own node_modules -- it never installs
*that* package's own dependencies, since this repo uses plain file:
references rather than true npm workspaces. cyclonedx-npm shells out
to npm ls --all, which walks into the symlink and reports it broken
whenever packages/contracts/node_modules is empty -- exactly what the
sbom job's steps left it as, unlike test/server/e2e which already
gained an equivalent install step in an earlier fix.

Added the same 'install @modelforge/contracts's own deps' step here.
Verified locally: removed packages/contracts/node_modules entirely,
reproduced the identical ELSPROBLEMS output CI showed, then confirmed
both frontend's and app's SBOM generation succeed cleanly (exit 0,
zero warnings) once that install step runs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

.github/workflows/ci.yml

@@ -430,10 +430,26 @@ jobs:
           node-version: 22
           cache: npm
           cache-dependency-path: |
+            packages/contracts/package-lock.json
             frontend/package-lock.json
             app/package-lock.json
             mastervault-mcp-server/package-lock.json
 
+      # frontend/ and app/ both depend on this via `file:../packages/contracts`.
+      # `npm ci` in either only symlinks packages/contracts itself into their
+      # node_modules — it never installs *that* package's own dependencies
+      # (zod, typescript) into packages/contracts/node_modules, since this
+      # repo uses plain `file:` references, not true npm workspaces. cyclonedx-
+      # npm shells out to `npm ls --all`, which walks into that symlink and
+      # reports it as broken ("missing: typescript, zod, required by
+      # contracts@npm:@modelforge/contracts") whenever this step is skipped —
+      # confirmed by reproducing the exact ELSPROBLEMS/exit-254 failure this
+      # job hit in CI, byte for byte, with packages/contracts/node_modules
+      # absent, and confirming it clears once this step runs.
+      - name: Install @modelforge/contracts dependencies
+        working-directory: packages/contracts
+        run: npm ci
+
       - name: Install frontend dependencies
         working-directory: frontend
         run: npm ci