docs: cyclonedx-py ships with the CLI, it is not fetched

[vpetersson-bot]

Surfaced by the automated review on sbomify-action#398, verified against the action's source before changing anything.

The claim

Six pages said or implied that every generator is downloaded on first use:

Page	Said
sources.md	"The generators are not baked into the container image. They are downloaded on first use"
how-it-works.md	"The generators are not baked into the image - they are fetched on first use"
advanced.md	"The generators are not baked into the container image"
quickstart.md	"the generators are downloaded on first use and cached"
runtimes/local.md	"The generators are downloaded on first use and cached"
runtimes/docker.md	image contents listed without it

The reality

cyclonedx-bom is a hard dependency in the action's pyproject.toml:

dependencies = [
    "cyclonedx-bom>=7.2.1,<8",

and _generation/generators/cyclonedx_py.py resolves the binary with check_tool_available("cyclonedx-py") — off PATH, not through the runtime fetcher. So cyclonedx-py is always present, and Python SBOMs generate with no fetch at all.

That is a meaningful difference for anyone reading these pages to plan an air-gapped build or reason about SBOMIFY_FETCH_RUNTIMES=0.

What changed

Only the phrasing that overstated it. The fetched list in advanced.md was already correct and is untouched, and the practical claim — nothing to install — stays true on every page.

Verification

• bun run lint — passes
• hugo --minify --environment production — clean, 493 pages
• All 16,111 internal links and anchors resolve

🤖 Generated with Claude Code

https://claude.ai/code/session_01UatuV4CjoCupLTRYNbD3Wq