[WIP] Review release process for software traceability

[Claude]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Ensure packaged software can be traced back to the commits that built it</issue_title>
<issue_description>### Task Type

task

Description

Review all sub-projects and the release process.

Ensure that attestations and/or SBOM, etc. are used as needed to ensure that any packaged release of the project's sub-projects can be traced back to the original commit that was used as the basis.

Priority

p1-high

Domain

security

Agent Processing

• This issue is suitable for autonomous AI agent processing.</issue_description>

<agent_instructions>Do .agents/skills/plan-work/SKILL.md issue_number=207</agent_instructions>

Comments on the Issue (you are @claude[agent] in this section)