fix(release): SBOM path glob so best-effort SBOM never blocks release (Sigilix P1)

[Desperado]

Addresses the P1 Sigilix flagged on #6. The gh release create step passed the literal 9lives.cdx.json; shopt -s nullglob only skips globs, so if the best-effort (continue-on-error) SBOM step failed, gh release create would error with 'no such file' and block the release. Now *.cdx.json — nullglob drops it when absent. (v0.1.3 only shipped because the SBOM step happened to succeed.)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[sigilix]

---

_{Posted · 99ecc1a · 0 findings — View review}

Sigilix is reviewing this pull request.

A structured overview will replace this note when retrieval and specialist review complete.

== cartographer's window ==
     .--------------------------------------------------.
    /  o      o      o      o      o      o      o      \
   |------------------------------------------------------|
   |   .       *          .--------.          *       .   |
   |        .            /  branch \              .       |
   |   *          .-----*----*-----*----.             *   |
   |             /       \    \     \    \                |
   |      .     *----*----*----*-----*----*      .        |
   |             \        \    \     \    /               |
   |   .          '----*---*----*---*----'        *       |
   |        *          \        .       /                 |
   |   map what changed, keep what matters        .       |
   |------------------------------------------------------|
    \__o______o______o______o______o______o______o_____/
          .              .           *              .

each branch becomes a little sky
we map the risk before the road