feat(sbom): generate SBOM per platform for multi-platform images

[reyreavman]

Summary

For a multi-platform image the SBOM was generated once per image name: syft scanned the index tag (yielding whatever platform the build host pulled), the io.werf.target-platform annotation was taken from the first platform image, the base SBOM was merged from the first platform only, and the in-toto subject pointed at the index digest. This PR generates one SBOM per platform, attached to the fallback tag of that platform's manifest digest, with a truthful subject, annotation and per-platform base/import merge — the cosign v3 discovery model (cosign sign --recursive / verify-attestation --platform).

Key changes

• Per-platform generation: convergeImageSbom runs the single-platform pipeline once per platform image (own stage descriptor, own base/import SBOM merge, own scan options, own platform annotation). The branch that built a throwaway MultiplatformImage with an always-nil stage descriptor is deleted, removing a latent nil dereference along the way.
• Cache: target platform is included in the SBOM checksum (only when set — single-platform checksums stay byte-identical, proven by unchanged golden hashes) and passed to the backend pull.
• Legacy bases: building on top of a multi-platform base whose SBOM was attached to the index digest by an older version now fails with an actionable "rebuild the base image with a newer werf version" error instead of silently merging a platform-ambiguous SBOM.
• CLI:
  • werf sbom get and werf attest get/verify accept --platform; an index reference without it fails listing the available platforms and their digests (no host-platform default). sbom get IMAGE_NAME selects the exported image by platform instead of taking the first name match.
  • werf attest ls expands an image index and lists the attestations of every platform in one table with a PLATFORM column.
  • --platform against a single-platform manifest is validated against the config platform (mismatch is an error, not a silent pass-through); platform input is normalized (linux/arm64/v8 → linux/arm64) consistently across sbom and attest commands; variant matching is restricted to os/arch requests (bare linux is rejected). New helpers live in pkg/oci/artifact/platform.go.
• Cleanup: no new deletion logic — the existing digest-generic orphan pass collects per-platform fallback tags once the platform manifests are deleted; covered by new discovery-layer and delete-loop tests.
• e2e: new multiplatform-labeled suite asserts per-platform artifacts, subjects, annotations, absence of an index-digest artifact and cache reuse on rebuild.
• Spec-kit artifacts for the feature added under specs/016-sbom-multiplatform-per-platform/ (status: migrated).

Why

Signing an SBOM asserts "this SBOM correctly describes this image". The old model produced an SBOM that claimed one platform while describing another, which made multi-platform SBOM signing (the parent feature) impossible to do honestly. Per-platform SBOMs attached to platform manifest digests are what the OCI distribution-spec referrers model prescribes (association is strictly per manifest digest) and what cosign discovery expects, so cosign verify-attestation --platform <index-ref> works out of the box.

Verification

• Deletion-chain audit for cleanup: platform stages of a deleted index are deleted in the same run (no protection left), making their fallback tags orphans; a platform stage shared with another protected index correctly keeps its SBOM.
• Storage model checked against OCI image-spec 1.1 (subject/artifactType/empty-config artifact guidelines) and distribution-spec 1.1 (referrers tag schema is per subject digest — one fallback tag per platform manifest is the prescribed layout).
• The e2e suite could NOT be run locally (macOS): it needs Linux CI with docker buildx + QEMU binfmt (task test:setup:environment). It is the merge gate for the end-to-end claims (subject/annotation/index-absence/cache).
• Manual QA against a live registry was not performed.

Review focus / risks

• Breaking change docs(readme): focus on Deckhouse Delivery Kit #1 (accepted, no feature flag): builds on top of multi-platform base images whose SBOM is in the legacy index-attached format fail until the base is rebuilt. Single-platform bases are unaffected. Needs release-notes visibility. The legacy hint in the error is unconditional — the format cannot be detected (registries have no child→parent resolution).
• Breaking change docs: remove irrelevant documentation #2 (intended fix): sbom get --tag/--digest on a multi-platform reference now errors with a platform list instead of silently returning the build host's platform SBOM.
• Stage digests and content-based tags are NOT affected — the platform enters only the SBOM artifact checksum annotation, so no user stage cache invalidates and no tags move. Multi-platform SBOM artifacts regenerate on first build after upgrade (old index-attached ones become orphans and are collected by cleanup).
• pkg/sbom/image.PullSBOMByTag (exported) is removed — its single caller moved to command-level resolution.
• pkg/build/build_phase.go: verify the per-platform loop uses the loop variable everywhere (base/import/scan/gost/platform) — the old code took everything from images[0], and this property is guarded only by the e2e suite.