agent-bom v0.91.0

What's Changed

• docs(release): 0.90.1 hygiene — soften SCA framing, fix stale pins, README callouts by @msaad00 in #3314
• fix(sca): honor NVD CPE inclusive/exclusive version bounds exactly by @msaad00 in #3315
• fix(output): surface match_confidence_tier across SARIF, JSON, HTML by @msaad00 in #3317
• fix(release): harden post-0.90 audit findings by @msaad00 in #3316
• fix(output): carry match_confidence_tier on the JSON blast_radius rollup by @msaad00 in #3319
• fix(ui): fail fast offline and polish README how-it-works diagram by @msaad00 in #3318
• fix(sca): make NVD capped sync ingest its unsynced tail across runs by @msaad00 in #3320
• fix(version): correct post-release regex and prerelease ordering in version compare by @msaad00 in #3330
• fix(graph): keep cross-page attack paths in filtered /graph by @msaad00 in #3321
• fix(cli): fail-close --fail-on-severity on unknown/none findings by @msaad00 in #3322
• fix(mcp): emit canonical OWASP codes from tool-abuse rules by @msaad00 in #3323
• fix(sarif): de-duplicate cloud CIS failures in SARIF output by @msaad00 in #3324
• fix(inventory): keep distinct MCP servers distinct across identity, enrichment, and Cortex audit by @msaad00 in #3325
• chore(deps): combine UI dependency updates by @msaad00 in #3337
• fix(model-scan): close pickle-scan size gate and memo evasion by @msaad00 in #3326
• fix(version): honor tagged bounds for Go pseudo-versions by @msaad00 in #3327
• fix(image): warn on legacy rpmdb instead of silent zero coverage by @msaad00 in #3328
• fix(mcp): block SSRF in repo scan and offload clone off the event loop by @msaad00 in #3329
• feat(ui): design-system foundation — Collapsible, Card/Section, entity icons, vendor logos, state primitives by @msaad00 in #3338
• fix(sca): harden OSV/NVD/KEV/GHSA sync + SQLite concurrency (availability) by @msaad00 in #3339
• feat(ui): real connections experience — vendor logos + connector cards wired to backend by @msaad00 in #3340
• fix(api): bind audit tenant server-side, harden rate-limit identity + global ceiling by @msaad00 in #3341
• fix(output): dedup CycloneDX components + scope finding id by package by @msaad00 in #3342
• fix(ui): align connections screenshot spec with redesigned headings by @msaad00 in #3344
• feat: capability-depth — reachability→CVE, perf, identity owner-binding, FinOps rates, SBOM attestation/SPDX2 by @msaad00 in #3346
• feat(ui): declutter, capability-driven IA, interaction-state fixes, real trust stack by @msaad00 in #3347
• feat(gateway): OAuth 2.1 AS conformance + inline A2A mutual-auth enforcement + per-tool-call scope/DLP by @msaad00 in #3348
• chore(release): v0.91.0 by @msaad00 in #3349

Full Changelog: v0.90.0...v0.91.0