chore(security): make SBOM generation deterministic

feat(security): ADR-0014 CI security scanning + shared scan definition

Stage: pinned deps, API-key fallback, apt probe, security scan