v0.27.1

What's Changed

• build(deps): bump go.opentelemetry.io/otel/sdk from 1.45.0 to 1.47.0 by @dependabot[bot] in #488
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6 by @dependabot[bot] in #489
• chore: build against a local SDK; the pre-push hook runs unit tests; AGENTS.md only by @bomly-guy in #490
• docs: the SDK's CLI compatibility job is opt-in; smoke goldens stop pinning the tool version by @bomly-guy in #491

Full Changelog: v0.27.0...v0.27.1

---

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.