v0.87.0

Added

• GitLab's Dependency List and License Compliance tab are populated. Both read a CycloneDX
  SBOM rather than a report of their own, and Draugr's SBOM already carries SPDX identifiers in
  each component's licenses — the only form GitLab reads. The template collects
  draugr-out/sbom-*.cdx.json, so enabling config.sbom in the descriptor is all it takes, and
  one artifact fills both: every package with its version and its licence. Ultimate tier.

• DRAUGR_GATE_DEFAULT_BRANCH in the GitLab template, because gating the default branch and
  populating GitLab's merge-request widgets turn out to be mutually exclusive. GitLab baselines
  those widgets against the default branch's last successful pipeline, so a project whose default
  branch legitimately fails the gate never establishes one — the reports upload and there is
  nothing to compare them against. On by default, since a gate that does not fail is not a gate;
  set it to "false" to keep the default branch green and reporting, and leave gating to the
  merge-request path. The guide gives the trade-off as a table.

Fixed

• The GitLab template's merge-request diff compares the right two trees. It named the base
  descriptor while standing in the head checkout, and a component's url: . resolves against the
  working directory — so both scans read the head, every diff reported no change, and the
  differential gate could not trip. It failed green, which is the only way a gate fails that nobody
  notices. The base is scanned from inside its own worktree now, as the GitHub Action already did.

• The GitLab template's merge-request diff has something to diff. --report replaces the
  default json,sarif rather than adding to it, so a job asking only for GitLab's own formats
  wrote no results.sarif — and the diff then failed on a missing file, which points at the diff
  rather than at the report list that caused it. The template names sarif explicitly, and a test
  now checks that whatever the template diffs is a format it asked the scan to write.