Supply-chain graph — Phase 7 (deferred): SBOM/scan ingestion + CVE queries

[toddysm]

Phase 7 of the supply-chain graph. Part of #168.
Design: docs/architecture/observability/supply-chain-graph.md (PR #169).

Status: deferred per the #168 review — filed so the backlog is complete.
Do not start until the earlier phases land and we choose to pick this up.

Goal

Add package/file inventory, vulnerabilities, and CVE queries.

Deliverables

• Ingest SBOM (SPDX) and vulnerability-attestation referrers into Package,
  File, Layer, and Vulnerability nodes (CONTAINS, AFFECTED_BY).
• cssc-graph find --package/--file, impact (blast radius), and introduced
  (earliest evidence-backed introduction point, tagged with confidence).
• Optional inventory/ cache of SBOM/scan payloads for offline rebuilds.

Dependencies

Depends on #171 (indexer) and #173 (query layer).

Acceptance

• Given a CVE, list affected artifacts and deployments and identify the earliest
  evidence-backed introduction point in each lineage (never a fabricated one).
• Given a package or file, list every artifact/layer where it is present.

[toddysm]

Cross-reference: the #168 gap analysis identified vulnerabilities/CVE modeling + introduction-point/impact (bucket 2) as unmet. That scope is this issue (Phase 7). Related new gap issues from #168: inventory (#228), typed evidence (#230), and property/CVE-aware discovery (#229) are prerequisites/companions for CVE queries here.