ci(security): add secret scan and SBOM

docs/verification/jt-017-dotnet-provenance.md

@@ -1,4 +1,4 @@
-# JT-017 .NET provenance verification
+# JT-017 supply-chain provenance verification
 
 ## Implemented
 
@@ -7,6 +7,10 @@
 - API and test projects opt into NuGet lock files.
 - Both direct and transitive package versions carry NuGet content hashes in committed `packages.lock.json` files.
 - CI restores both projects with `--locked-mode`, so unreviewed graph drift fails before build or test.
+- A standard-library tracked-file scanner blocks high-confidence credential patterns without printing values.
+- A deterministic CycloneDX 1.5 generator combines the npm, NuGet and hash-locked Python dependency graphs.
+- CI tests both controls, scans the tracked tree and generates a 964-component SBOM under ignored build artifacts.
+- The review/exception/credential-response rules are documented in `docs/security/supply-chain-policy.md`.
 
 ## Proof
 
@@ -14,12 +18,16 @@
 - A subsequent locked restore passed.
 - Full backend suite: 719/719 passed.
 - `dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitive` reports no known vulnerable packages from the current NuGet source.
+- Supply-chain unit tests: 3/3 passed, including seven synthetic credential canaries and deterministic npm/NuGet/PyPI coverage.
+- The current tracked tree has no high-confidence credential-pattern findings.
+- Repeated SBOM generation is byte-stable for unchanged lock inputs and includes React, Entity Framework Core and FastAPI representatives.
 
 ## Remaining JT-017 scope
 
 - Pin third-party CI actions and Docker images by reviewed immutable SHA/digest.
 - Hash or replace the downloaded `dotnet-install.sh` bootstrap path.
-- Add policy-owned SBOM, container and tracked-secret gates.
+- Retain the SBOM as a CI artifact once an immutable artifact action or approved runner store is available.
+- Add a policy-owned container CVE/licence scan with a tested canary once the Docker daemon/scanner is available.
 - Resolve or formally isolate the remaining Torch/Transformers advisories under the model-loading threat path.
 
-Those items require approved registry/action metadata or a separately reviewed scanner/update process; this increment does not invent immutable identifiers without verifying them.
+Those items require approved registry/action metadata, network-backed upstream verification or a separately reviewed scanner/update process; this increment does not invent immutable identifiers without verifying them.