release(sbom): prepare v1.1.0

[stacknil]

Release scope

Prepare sbom-diff-and-risk for the �1.1.0 GitHub Release after the merged opaque �om_ref identity fix.

Included:

• final package version 1.1.0 in project metadata and version
• v1.1.0 release notes covering input/policy contracts, policy decision explainability, canonical component identity, ecosystem canonicalization, and opaque bom-ref behavior
• current stable/reviewer/release-provenance routes and CI consumer example pinned to �1.1.0
• SARIF golden metadata and release contract tests synchronized to the final version
• reviewer-route validator synchronized to the current stable release

Design decision

�1.1.0 is a GitHub Release and artifact-provenance release. The existing tag workflow remains the source of truth for the wheel, sdist, checksum manifest, and attestations. Historical v1.0.0 notes remain linked as prior release evidence.

Main risk

Changing the stable pointer and package version can expose stale consumer examples or reviewer contracts. The release-prep tests and route validator pin those surfaces to the same final version.

Compatibility impact

CLI commands and flags remain unchanged. v1.0 report fields and legacy policy files remain readable. Production PyPI publishing remains explicitly deferred and is excluded from this release.

Rollback path

Before tagging, revert commit 4c4f693 or close this draft PR. After tagging, do not move the tag; use a follow-up corrective release and keep the published GitHub Release immutable.

Validation

• python -m pytest -> 225 passed
• python scripts\validate-reviewer-routes.py -> passed; 13 documents and 81 reviewer-surface links checked
• python -m build -> sbom_diff_and_risk-1.1.0 wheel and sdist built
• wheel metadata check -> Version: 1.1.0, no Author or Author-email
• gitleaks detect --no-git --redact -> no leaks found
• git diff --check -> passed