chore: remove docs/sbom/ (content migrated to devkit)

[RickCogley]

Summary

The evidence pipeline content in `docs/sbom/` was migrated to eSolia/devkit as part of the Phase 2 org restructure, and further developed in devkit v0.2.0 (see eSolia/devkit#5). This issue tracks the cleanup of the stale duplicate in this repo.

What moves where

The authoritative locations are now in devkit:

• Worker source → eSolia/devkit/workers/evidence-sink/
• Reusable workflow → eSolia/devkit/.github/workflows/attest-and-ship.yml
• OPA policy → eSolia/devkit/.github/policies/ci-security-v1.rego
• Runbook + SBOM guide → eSolia/devkit/docs/sbom/

Acceptance criteria

• `docs/sbom/` removed from this repo
• No consumer repo references any of these files (verified: consumers use vendored workflows from devkit)

InfoSec: no impact — content is already relocated to devkit.