feat: VpEngOps identity + SBOM/GLPI plans wired into lifecycle [#834]

Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).

scripts/grind-stack.sh

@@ -129,6 +129,23 @@ cmd_sweep() {
   echo "swept. Base images are kept for reuse; fleets untouched."
 }
 
+SYFT_IMAGE="anchore/syft:v1.18.1@sha256:b8c170b8e51bfc4779ec3ef4399942c57290f5ce76a9c3af564c9d00d4946a6b"
+
+cmd_sbom() {
+  PKG="${1:?usage: grind-stack.sh sbom <pkg-dir>}"
+  [ -f "$PKG/CloudronManifest.json" ] || die "no CloudronManifest.json in $PKG"
+  APPNAME="$(basename "$PKG" | tr '[:upper:]' '[:lower:]')"
+  IMAGE="grind-$APPNAME:test"
+  docker image inspect "$IMAGE" >/dev/null 2>&1 || die "no test image $IMAGE - run 'up' first (sbom runs BEFORE sweep)"
+  echo "== grind sbom: $IMAGE -> CycloneDX"
+  # syft via pinned container (no host installs); reads the docker daemon
+  docker run --rm --cgroup-parent "$SLICE" -v /var/run/docker.sock:/var/run/docker.sock \
+    "$SYFT_IMAGE" "$IMAGE" -o cyclonedx-json > "$PKG/sbom.cyclonedx.json" \
+    || die "syft failed"
+  jq -r '"  components: \(.components | length), tool: \(.metadata.tools[0].name // "?") \(.metadata.tools[0].version // "")"' "$PKG/sbom.cyclonedx.json" 2>/dev/null || true
+  echo "wrote $PKG/sbom.cyclonedx.json [#834] - commit it with the package"
+}
+
 cmd_preflight() {
   ROOT="$(docker info --format '{{.DockerRootDir}}')"
   echo "docker root: $ROOT"