Graph inventory: model image layers, packages, and files

[toddysm]

Part of the file-backed supply-chain graph requirements (#168). Identified by the #168 gap analysis (bucket 1: inventory).

Problem

The current graph models occurrences, artifacts, tags, deployments, annotations and their supply-chain edges, but has no layer, package, or file inventory. Requirements in #168 ("Layer, package, and file inventory") are unmet.

Scope

• Add Layer, Package, File nodes and relationships to Occurrence/Artifact (associated with the platform-specific manifest that was scanned).
• Record ordered layers of a manifest.
• Track packages with stable identifiers (PURL when available): version, type, supplier, licenses, source evidence.
• Track files: path, digest, size, mode, owner, originating layer.
• Associate packages/files with the layer that introduced/changed/removed them when evidence exists.
• Preserve whiteout/removal semantics (final-filesystem interpretation) so removed files are not reported as present.
• Support inventory queries at both the per-layer and final-artifact views.

Notes

• Ingestion of the underlying SBOM/scan data is tracked by Phase 7 (Supply-chain graph — Phase 7 (deferred): SBOM/scan ingestion + CVE queries #176); coordinate the data source with that issue.

Acceptance criteria

• Schema + indexer support Layer/Package/File nodes and their edges.
• Queries expose per-layer and final-filesystem inventory views.
• Whiteout/removal semantics covered by tests.
• Docs updated in docs/architecture/observability/supply-chain-graph.md.