v3.3.1

[3.3.1] - 2026-08-20

Fixed

• The release pipeline's SBOM step used --outfile; cyclonedx-bom 7.x
  spells it --output-file, so the v3.3.0 release build failed before
  publishing anything (the version-match, test, benchmark, wheel-content
  and twine gates had all passed). The flag is corrected and the tool is
  now pinned exactly, for the same reason ruff is: a release pipeline
  must not absorb upstream CLI changes as surprises. v3.3.0's tag remains
  where it was - tags are immutable here; the fix ships as a new version.