v1.2.1 — SPDX export correctness

What's new

SPDX export correctness — aisbom scan --format spdx now produces a compliance artifact worth handing to an auditor. Every SPDX document the CLI produced previously named all artifacts unknown-model, reported Type: unknown, and carried no checksums.

• Real filenames and formats: models appear under their actual filename with their real format (pickle, safetensors, gguf).
• SHA256 checksums: SPDX packages now carry the checksum of the scanned file — the single most load-bearing field in a security SBOM. Remotely-scanned artifacts, whose bytes are never fully read, omit the field rather than assert a placeholder.
• Deterministic documents: package identifiers are now derived from file content instead of a process memory address, so scanning unchanged inputs twice produces identical SPDX identifiers. SPDX SBOMs can now be diffed meaningfully in CI.
• Correct tool attribution: creators reports the running CLI version instead of a hardcoded aisbom-cli-0.1.0.

Fixes

• --format spdx no longer crashes on a requirements.txt that repeats a pin, or that uses a wildcard version such as torch>=2.0.*.
• --format spdx no longer crashes on a scan that finds no models and no requirements.

All three previously produced an invalid document and an unhandled traceback.

What's not changing

Scanner behavior, exit codes, and CycloneDX output — all identical to v1.2.0. CycloneDX output is byte-for-byte unchanged; this release touches the SPDX path only.