docs: document TeamCity VCS detection, drop deprecated SBOM_VERSION

[vpetersson-bot]

Follow-up to #138, which merged just before these two commits landed on the branch. Covers sbomify-action#395 and #399, both merged today.

TeamCity VCS detection (#395)

The TeamCity page documented the opposite of what shipped — "TeamCity does not expose repository details in the form the action auto-detects" — and both support matrices listed it as Manual.

Verified against providers/teamcity.py on master rather than the PR description:

• Detection is default-deny. TeamCity is VCS-agnostic and exposes no VCS-type parameter, so nothing is emitted unless the repository URL positively identifies Git (.git suffix, recognised host, or ssh:// / git@host:path). A Perforce changelist written into a Git-shaped VCS field would be a false claim in a document you may go on to sign.
• SBOMIFY_VCS_URL / SBOMIFY_VCS_REF are TeamCity-only. The other three providers do not read them — checked, not assumed. They exist because TeamCity keeps the repository URL and branch in a properties file rather than the environment, and a containerised step may not be able to read it.
• A self-hosted Git URL with no .git suffix and no recognised host cannot be detected at all.
• No commit URL is emitted, unlike the other three runtimes. The path to a commit differs by forge (/commit/, /-/commit/, /commits/), so the URL and SHA are recorded without a browsable link rather than guessing one that may not resolve.

Both matrices now say Git roots rather than Manual, with a legend entry explaining why it is not a plain yes.

A bug in the manual fallback

The page's sbomify.json example used %teamcity.build.branch%. That reports the literal string <default> on the default branch when a branch specification is configured (TW-23699), and is absent entirely when one is not — neither gives you the branch name. Now %teamcity.build.vcs.branch.<VcsRootId>%, with a callout explaining the trap.

On staleness

Detection landed after v26.8.0. The page says exactly that, phrased as a historical fact rather than a "not yet released" note, so it stays true as releases ship.

Deprecated SBOM_VERSION (#399)

how-to-version-sboms told readers to set SBOM_VERSION, which is deprecated and logs a warning on every run. Now COMPONENT_VERSION. The deprecated-aliases table in configuration.md keeps its entry — that is what the table is for.

Coordination with sbomify-action#398

#398 slims the README and drops the TeamCity sections #395 added, on the basis that the content lives here. I checked that claim line by line against #395's README diff; everything was covered except the commit-URL behaviour, which is why the second commit adds it. Nothing is lost when #398 merges.

Verification

• bun run lint — passes
• hugo --minify --environment production — clean, 493 pages
• All 16,111 internal links and anchors resolve

🤖 Generated with Claude Code

https://claude.ai/code/session_01UatuV4CjoCupLTRYNbD3Wq