feat: carry controlled SBOM source refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118

tests/test_sbom_nexus_context_resolver.py

@@ -93,6 +93,12 @@ def test_catch_up_returns_ranked_targets_and_fleet_counts(monkeypatch) -> None:
                     "sbom_age_days": 9999,
                     "has_sbom": False,
                     "checkout_available": True,
+                    "source_ref": {
+                        "kind": "forgejo-archive-v1",
+                        "repository": "coulomb/never-scanned",
+                        "revision": "a" * 40,
+                        "observed_ref": "refs/heads/main",
+                    },
                 },
                 {
                     "repo_slug": "activity-core",
@@ -131,6 +137,7 @@ def test_catch_up_returns_ranked_targets_and_fleet_counts(monkeypatch) -> None:
     assert result["never_count"] == 93
     assert result["total_count"] == 111
     assert result["repos"][0]["has_sbom"] is False
+    assert result["repos"][0]["source_ref"]["revision"] == "a" * 40
     assert result["repos"][2]["checkout_available"] is False
 
 
@@ -266,6 +273,43 @@ def test_apply_processes_only_fixed_targets_and_records_terminal_outcomes(monkey
     assert first_key != client.posts[1][2]["Idempotency-Key"]
 
 
+def test_apply_posts_frozen_source_ref_and_accepts_source_outcome(monkeypatch) -> None:
+    source_ref = {
+        "kind": "forgejo-archive-v1",
+        "repository": "coulomb/scan-me",
+        "revision": "b" * 40,
+        "observed_ref": "refs/heads/main",
+    }
+    client = _install(monkeypatch, _payload([]))
+    client.post_results = {
+        "/sbom/scan-me/ingest": [
+            DummyResponse(
+                {
+                    "repo_slug": "scan-me",
+                    "status": "skipped",
+                    "reason": "source-unavailable",
+                    "snapshot_id": "source-skip-1",
+                }
+            )
+        ]
+    }
+
+    result = apply_bounded_ingest(
+        [
+            {
+                "repo_slug": "scan-me",
+                "checkout_available": False,
+                "source_ref": source_ref,
+            }
+        ],
+        operation_id="run-controlled-source",
+    )
+
+    assert result["attempted_count"] == 1
+    assert result["skipped"][0]["reason"] == "source-unavailable"
+    assert client.posts[0][1] == {"source_ref": source_ref}
+
+
 def test_ambiguous_ingest_failure_does_not_create_synthetic_skip(monkeypatch) -> None:
     client = _install(
         monkeypatch,