synoptic v0.8.0 — queried pages + projection secret-scan

The graph pipeline, releasable.

• graph — evidence → one linked JSON-LD via parse plugins (org·packages·lattice·jargon·palette·resume), each derivation attested; cross-site bridge.
• build-site — pages are queries (by @type/property/keyword, never id): a page is a bounded semantic scope; the query is recorded in the graph→site attestation. Components carry content + design provenance; data-provenance on every element.
• sbom — the CLAIMS SBOM (SPDX-2.3), edges unrolled (buildsOn→DEPENDS_ON, isPartOf→CONTAINS).
• secret-scan — rudimentary secret scanning on the projection before publish; redacts digests, catches pasted keys/tokens/JWTs/emails.
• Signs only axioms; sites are thin (config + plugins); one core, both sites, bridged.