fix(sbom): stable component order independent of filesystem walk

[vibgrate-team]

Summary

vg sbom export used to emit direct scan rows in scan order, which follows the filesystem walk, and sorted only the lockfile-only rows after them. The same tree could therefore produce a different components order, different SPDXRef-Package-N ids, and a different order of dependency entries.

SBOM component and dependency arrays are now sorted before serialization:

1. Package URL, when the component has one
2. otherwise the package name
3. then version

Rows that share a purl and version are ordered by name. CycloneDX dependencies still starts with vibgrate-root, followed by the components in that order. Directory walk order and map iteration no longer change components, SPDX packages, or those dependency entries. Document ids stay content-derived. vg export CycloneDX and SPDX use the same order.

A fixture test runs the export twice, reversing the lockfile component list and the edge map and moving a package with no purl inside the same project. Both runs emit identical CycloneDX and SPDX documents, serial number included.

Related issues

Closes #286

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated where behavior changed
• Determinism preserved
• No proprietary or internal references
• Commits use Conventional Commits and are signed off

How to verify

pnpm test
pnpm lint
pnpm typecheck