feat(sbom): CUST-WP-0013 — expand SBOM infra to terraform, ansible, and tool manifests

- Migration d6e7f8a9b0c1: add terraform, ansible, tool to Ecosystem enum
- ingest_sbom.py: new Ansible Galaxy requirements.yml parser (collections + roles)
- ingest_sbom.py: new sbom-tools.yaml manifest parser (agent-generated tool deps)
- ingest_sbom.py: promote .terraform.lock.hcl parser from ecosystem=other → terraform
- ingest_sbom.py: detect_all() runs all four parsers in one comprehensive scan
- capture_sbom_tools.py: agent-assisted tool manifest generator (claude -p)
- prompts/sbom-capture-agent.md: parameterised prompt for repo tool discovery
- Makefile: capture-tools target; ingest-sbom updated docs and DRY_RUN support
- 29 unit tests covering all new parsers and detect_all() behaviour
- canon/standards/sbom-convention_v0.1.md: updated with four-mechanism model and workflow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/versions/d6e7f8a9b0c1_sbom_ecosystem_expand.py

@@ -0,0 +1,30 @@
+"""SBOM ecosystem enum expansion: add terraform, ansible, tool
+
+Revision ID: d6e7f8a9b0c1
+Revises: c5d6e7f8a9b0
+Create Date: 2026-03-12 00:00:00.000000
+"""
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "d6e7f8a9b0c1"
+down_revision: Union[str, None] = "c5d6e7f8a9b0"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # PostgreSQL requires each ADD VALUE in its own statement and cannot be
+    # run inside a transaction that also modifies data. ADD VALUE is
+    # transactional in PG 12+ (no COMMIT needed).
+    op.execute("ALTER TYPE ecosystem ADD VALUE IF NOT EXISTS 'terraform'")
+    op.execute("ALTER TYPE ecosystem ADD VALUE IF NOT EXISTS 'ansible'")
+    op.execute("ALTER TYPE ecosystem ADD VALUE IF NOT EXISTS 'tool'")
+
+
+def downgrade() -> None:
+    # PostgreSQL does not support removing enum values without recreating the
+    # type. Document the limitation and do nothing — reverting this migration
+    # requires a full type recreation if needed.
+    pass