Dependency upgrade and SBOM release assets

• Publishes a CycloneDX Software Bill of Materials (SBOM) as a release asset.
• Bumps the transitive postcss and nanoid dependencies to patched versions. The published bundle is unchanged — a fresh install already resolved to the patched versions.