fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base

[seonghobae]

What

Update .github/workflows/sbom-generation.yml to:

• run on pushes to main, master, and develop, so default-branch commits publish dependency snapshots;
• use github.sha as the final concurrency fallback instead of github.ref;
• add a permanent static contract test covering push triggers, commit-SHA concurrency, snapshot submission, write permission, and closed-PR behavior.

This clean replacement is stacked on #731 so it can be validated against the repaired central security/review baseline. It supersedes #736, whose branch could not be rebased safely through the connector.

Why

Dependency review compares base and head dependency graphs. Without a default-branch dependency snapshot, the action sees zero base snapshots and treats the whole dependency set as newly added, repeatedly re-reporting pre-existing findings. The push trigger restores the intended diff-scoped semantics without weakening whole-repository scanners.

github.sha is required for push events because github.ref would put every push to one branch in the same cancel-in-progress group; a later push could cancel the earlier snapshot and recreate the missing-base defect.

Verification contract

tests/test_sbom_generation_push_contract.py proves:

• main, master, and develop pushes are included;
• pull-request and release triggers remain present;
• SPDX generation still submits dependency-snapshot: true;
• push concurrency falls back to github.sha, never github.ref;
• closed PRs only run the cancellation sentinel;
• push and release events run generate-sbom with job-scoped contents: write.

Exact-current-head checks and independent approval remain mandatory. After #731 merges, this PR will be retargeted to main before merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3aa1854d-c67e-4905-8206-c0ec33915652

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

PR #736 was automatically merged into its stacked base branch #731 at commit 0b6a188ab1a6e96b8450c47c7d5313c4c708fd39 after the base retarget. This replacement now duplicates changes already present in #731, so it is being closed without merge.