feat(sbom): generate file-based package SBOMs without docker.sock

[reyreavman]

Summary

SBOM generation for a stapel image with file-based packages no longer mounts
/var/run/docker.sock into the scanner container, so it now runs in environments
where the docker socket is unavailable or forbidden. syft is invoked per packages
directive against a directory source built from only the declared spec/lock files,
instead of walking the whole image filesystem and post-filtering the result.

What

• For a stapel image with file-based packages, syft runs once per directive against a dir: source containing only that directive's declared spec/lock files; the scanner container receives no /var/run/docker.sock mount.
• The declared files are read from the built image with the same image-read mechanism os-pm uses, and materialized into a temporary directory with their workdir-relative layout (spec next to lock) so the directory cataloger can link them.
• Per-directive BOMs are unioned and deduplicated by normalized PURL; the top-level BOM component is restored to the image (type=container, name=repository, version=tag) rather than the temporary scan directory syft reports for a dir: source.
• Dockerfile images are unchanged: full-image docker: scan, docker.sock still mounted.
• The SBOM artifact format version is bumped 3 -> 4: an image carrying a legacy full-scan SBOM regenerates it on the next build, while an unchanged rebuild reuses the cache.
• Removed FilterBOMBySourcePaths and the cataloger filter modes (CatalogerFilterMode): a targeted directory scan surfaces no foreign components, so the post-scan filter is a no-op.
• Does NOT change: os-pm collection, VEX, SBOM signing, skip-without-packages, multi-platform per-platform reads, or the ecosystem coverage (go-mod, pip, uv, poetry, npm, yarn, pnpm, cargo, lua-rock).
• UNVERIFIED: component-set equivalence (name+version+PURL) with the previous full-scan+filter output rests on syft's directory-tag catalogers producing identical output on a dir: source; the e2e sbom suites are the oracle and did not run on the macOS dev host.

Why

The docker: source forced a docker.sock mount and a whole-image filesystem walk,
then discarded everything outside the declared spec/lock with a post-filter — costly,
and impossible where the socket is forbidden. Because network is disabled for shell
stages under build.sbom.enable=true and installs are frozen/locked, the spec/lock in
the image are byte-identical to source, so scanning just those files is equivalent to
the old scan-then-filter. The rejected alternative was syft-as-a-library, which would
add an external dependency; this keeps the same pinned scanner image and the existing
image-read path, adding no new dependency.

[reyreavman]

Verification

• Local (macOS): task build exit 0; task lint scoped to the changed packages (.golangci.yml) reports 0 issues; task test:unit across ./pkg/sbom/..., ./pkg/build/..., ./pkg/container_backend/... — 22 suites green.
• Mutation: not run on the new tests. To settle them: break relativeToWorkdir so spec/lock no longer land adjacent → materialize_test.go layout assertion must fail; drop the SourceTypeDir branch in mapSbomScanOptionsToDockerRunCommand → docker_server_sbom_test.go "without docker.sock" case must fail.
• Not run: the e2e sbom suites (test/e2e/sbom: inject/, stage_dependencies, packages_merge) — they assert component sets and are the equivalence oracle, but require Linux + Docker + kind and cannot run on the macOS dev host.

Review focus

• pkg/build/sbom_step.go scanFileBasedPackages: per-directive union via MergeBOMs plus the explicit container-metadata override — confirm the dir: path does not drop a metadata surface a downstream SBOM consumer relied on from the old docker: scan.

Follow-up

• BLOCKER: run task test:e2e paths="./test/e2e/sbom/..." labelFilter="sbom" and task test:integration on Linux/CI to settle the UNVERIFIED equivalence claim before merge.
• Out of scope: the SYFT_GOLANG_MAIN_MODULE_VERSION_FROM_CONTENTS / SYFT_FILE_METADATA_SELECTION env vars passed to the scanner do not exist in syft v1.45.1 (real keys are golang.main-module-version.from-contents / file.metadata.selection); left untouched here.