AI-BOM Generator v0.2.1

Highlights

• Restores the canonical Apache License 2.0 text for reliable SPDX detection.
• Enables GitHub-enforced immutable releases and verifies immutability for future tags.
• Separates mutable v0 and exact-version external consumer smoke workflows.
• Expands caller-setup-free Action coverage across Ubuntu, macOS, and Windows.
• Adds CodeQL, private vulnerability reporting guidance, and grouped Dependabot updates.
• Hardens release verification against PyPI propagation lag and malformed external smoke evidence.

Validation

• 128 unit and contract tests
• wheel and source distribution verification
• Ubuntu, macOS, and Windows managed-runtime smoke
• external exact v0.2.1 and mutable v0 consumer smoke
• CodeQL and PyPI Trusted Publishing with attestations