Adds `make bom` plus a reusable `pkg/bom` package that produces an
authoritative inventory of every container image AICR can deploy by
rendering each Helm chart in `recipes/registry.yaml` at its pinned
version, walking embedded manifests under `recipes/components/*/manifests/`,
and emitting:

- `bom.cdx.json` — CycloneDX 1.6 JSON (canonical, machine-readable)
- `bom.md` — human-readable Markdown summary

Modeling: AICR is the root component; each registry entry is an
`application` component; each unique image is a `container` component
with an OCI `purl`; `dependencies[]` wires the deployment graph. Output
is consumable by Trivy, Grype, and Cosign attestation without conversion.

Closes #740. Refs #739.

Image extraction handles Helm-templated manifests by stripping
`{{ ... }}` directives before YAML parsing — control-flow-only lines are
dropped, inline directives become a placeholder, so static `image:`
values still surface from mixed YAML/Helm files like the
network-operator and kubeflow-trainer manifests.

`pkg/bom` is structured for reuse: a follow-up will plumb it into
`pkg/bundler` so `aicr bundle` emits a per-bundle CycloneDX SBOM
alongside the generated install scripts (planned to be on by default,
no flag required).

Tested against the live registry: 22 components, 71 unique images
across 11 registries (NGC, ghcr.io, gcr.io, ECR, quay.io,
registry.k8s.io, cr.kgateway.dev, Docker Hub).

- Replace custom newUUIDv4 with google/uuid (already in go.mod) so BOM
  serial numbers are RFC 4122-conformant without hand-rolled crypto.
- Use pkg/errors with structured error codes throughout pkg/bom and
  tools/bom, replacing fmt.Errorf wraps to match project convention.
- Fix OCI purl spec compliance: repository_url now includes the full
  artifact path (registry/namespace/name) instead of stopping at the
  namespace; when both digest and tag are present, tag moves to the
  qualifier per spec. Tag-as-version remains the pragmatic fallback for
  the common no-digest case.
- BuildBOM and WriteMarkdown now copy the input slice before sorting so
  callers (notably the planned pkg/bundler integration) don't observe
  their input reordered.
- Replace boolStr helper with strconv.FormatBool.
- Lift helm-render ctx into renderHelmComponent so the WithTimeout
  cancel runs at end of helm work, not at end of the whole survey.
- Extract goconst-tripping defaults ("aicr", "NVIDIA Corporation") to
  named constants.
- Drop misleading "or empty string" docstring on componentValuesPath /
  componentManifestsDir; the path-joiner role is documented and callers
  stat-check before using.

PURL test updated to cover the spec-correct repository_url shape and
the digest+tag qualifier case.

Recurse into n.Alias for AliasNode so an `image:` value reached via a
YAML anchor + alias is still surveyed. Rare in K8s manifests but cheap
to handle and now covered by a regression test.

… Hub refs

Two correctness fixes surfaced in review:

1. `image: *anchor` was dropped. The recursion path landed in the
   ScalarNode case which is intentionally a no-op, so a scalar reached
   through an alias was never recorded. The image-key branch now resolves
   AliasNode targets before checking for a scalar.
2. `busybox:1.36` and `docker.io/library/busybox:1.36` produced different
   ImageRef.Repository values and therefore different PURLs, so the same
   Docker Hub image showed up twice in the BOM. ParseImageRef now
   canonicalizes single-segment Docker Hub refs to `library/<name>` per
   the Docker Hub default-namespace rule, matching the OCI purl-spec
   example `repository_url=docker.io/library/<name>` for official images.

Both fixes are covered by new test cases (direct scalar alias + library/
canonicalization across single-segment and fully-qualified inputs).

The decode-failure branch in ExtractImagesFromYAML was previously
unexercised by tests. Add a regression test that feeds malformed YAML
(unclosed flow sequence) and asserts a non-nil error is returned.