🧾 SBOM & VEX Release Evidence Gate

SBOM & VEX Release Evidence Gate turns owner-supplied normalized evidence into a deterministic local review gate. CycloneDX or SPDX SBOMs, VEX statements, release manifests, component identifiers, and artifact hashes are reviewed across separate tools before shipping. The bundled Python helper writes stable findings, a complete review manifest, JSON and Markdown reports, and a SHA-256 receipt. Returns missing-identifier, orphan-VEX, stale-statement, relationship, and digest-drift findings without scanning vulnerabilities or certifying compliance. It uses only the Python standard library, makes no network request, changes no account or system, and never treats READY as source proof, certification, a legal or security verdict, a reimbursement promise, or authorization to act.