Store bottle SBOM data in manifests

[MikeMcQuaid]

• Keep bottled SBOMs reproducible by moving pour-specific runtime, compiler and bottle package data into package manifests.
• Preserve per-platform supplements for :all bottles so installs merge only the current platform data.
• Avoid validating full SBOMs during pour by appending manifest supplement arrays.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR restructures how bottle SBOM data is persisted by moving pour-specific details (runtime deps, compiler/stdlib, and bottle package metadata) into GitHub Packages manifest annotations, then merging that data into the installed SBOM at pour time to keep bottled SBOMs reproducible.

Changes:

• Add SBOM “supplement” generation for pour-time-only package/relationship data and support generating “bottling” SBOMs that omit host-specific packages.
• Emit/consume SBOM supplements via GitHub Packages manifest annotations (including per-platform tag handling for :all bottles).
• Merge SBOM supplements during bottle pours without requiring full SBOM validation.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Library/Homebrew/sbom.rb	Adds SBOM supplement support, bottle-manifest annotation generation, and bottling/pour merge behavior.
Library/Homebrew/resource.rb	Parses SBOM supplement data from bottle manifest annotations (including :all tag selection).
Library/Homebrew/github_packages.rb	Uploads SBOM supplement annotations alongside bottle manifest metadata.
Library/Homebrew/formula_installer.rb	Merges manifest-provided SBOM supplements into the installed SBOM during bottle pours.
Library/Homebrew/dev-cmd/bottle.rb	Writes bottling SBOMs and includes SBOM supplements in generated bottle JSON / :all merge output.
Library/Homebrew/test/sbom_spec.rb	Adds coverage for bottling omissions, supplement generation, manifest annotation building, and pour-time merging.
Library/Homebrew/test/resource_spec.rb	Adds coverage for selecting the current-platform SBOM supplement from :all bottle manifests.
Library/Homebrew/test/github_packages_spec.rb	Verifies SBOM supplement annotations are included (and bottle package metadata is injected) in uploaded manifests.
Library/Homebrew/test/dev-cmd/bottle_spec.rb	Extends merge test coverage to include SBOM supplement tag aggregation in :all bottle JSON.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.