The tag release workflow now directly calls the reusable SBOM workflow and attaches that run's three generated documents after native publication succeeds. This removes the dependency on a workflow-token-created release event, which never launched the old attachment step.
The attachment job validates CycloneDX/SPDX format and release identity before upload, downloads all three published documents again, validates them, and compares their bytes to the generated artifacts. Main-branch SBOM scanning and manual SBOM runs remain available; tag generation now belongs to the release run.
Validation: regression coverage rejects a missing attachment, malformed JSON, wrong document format, empty comprehensive dependency inventory, and mismatched release version. Pickier and diff checks pass; CI runs the verification test. Actual attachment will occur on the next release, with no publication performed by this PR.
Closes #280.