v1.3.9

• docs/security/supply-chain.md §1: rewrote the converted-set listing to name
  all 24 OpenSecOps components alphabetically, and replaced the Python-only
  conversion-artefact list with a two-shape description (Python-bearing
  components carry requirements.in/requirements.txt/SBOM/provenance;
  libraryless components emit a deterministic git archive HEAD source tarball
  plus a SLSA Build L1 in-toto provenance document, all Sigstore-signed
  identically). Reflects the steady-state where every component publishes
  through the same ./publish toolchain.

Full Changelog: v1.3.8...v1.3.9