SBOM GitHub Action for PG Atlas #33

Why

PG Atlas tracks the dependencies of public goods. Publishing an SBOM from CI lets HackProof show up there.

What to build

• Add the PG Atlas SBOM action (CycloneDX) to CI as documented by the SCF Public Goods Maintenance working group, submitting on pushes to main. Check their docs for the exact action and inputs.
• The repo has two dependency trees (apps/api/uv.lock and pnpm-lock.yaml), so generate and submit an SBOM for each.

Acceptance criteria

• The action runs green.
• The submission is visible to the PG Atlas maintainers.

See CONTRIBUTING.md for conventions.