The “Merge SBOMs” step previously discarded the entire Syft inventory and wrote a metadata-only document. A JSON-aware merger now preserves scanned components, dependency relationships, tool metadata and the root reference, then adds the declared Zig standard library and platform runtime dependencies. Supplement metadata uses the repository version and a real timestamp; the Zig version is explicitly attributed to the declared Pantry toolchain.
Validation: regression tests preserve graph edges and source immutability, reject empty inventories and reference collisions, and verify generated metadata. Processing the actual v0.0.92 Syft artifact retains its 717 scanned components and adds five runtime components. Pickier and diff checks pass; CI runs the tests. Actionlint's remaining warning is the existing release-attachment action removed by #294.
Closes #296.