feat(sbom): project immutable Forgejo source refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/sbom-nexus-client-contract_v1.md

@@ -96,6 +96,41 @@ that the mutation may already have committed. The checkout path sent to Nexus
 is Nexus-local controlled-source identity, never authorization to mount a
 workstation path into the cluster.
 
+## Forgejo archive source-reference projection
+
+The `CUST-WP-0064` v1 source mechanism is available through a read-only
+resolution command:
+
+```bash
+rmgr sbom source-ref --path /path/to/checkout --slug example
+```
+
+Repo Manager reads the selected Git remote only to normalize identity. It then
+uses the anonymous Forgejo API—not local `HEAD`, the working tree, or a cached
+remote-tracking ref—to read repository visibility, default branch, and its full
+40-character commit SHA. The result contains `kind: forgejo-archive-v1`, exact
+`coulomb/<slug>` identity, `revision`, `observed_ref`, and a canonical UTC
+`observed_at`.
+
+V1 returns `supported: false` and no `source_ref` for a missing remote,
+non-Coulomb identity, slug mismatch, private repository, unavailable Forgejo
+record, invalid branch response, or unresolved full SHA. It never falls back
+to a workstation path or local revision.
+
+Projection is an explicit mutation and requires both service configuration and
+confirmation:
+
+```bash
+export SBOM_NEXUS_URL=https://sbom-nexus.example
+rmgr sbom source-ref --path /path/to/checkout --slug example \
+  --project --confirm-authoritative
+```
+
+The projection sends `checkout_path: null` plus the structured source reference.
+It succeeds only when Nexus returns the exact same `source_ref`; an older server
+that silently ignores the additive field fails closed. This makes the command a
+direct readiness probe for the SBOM Nexus side of `CUST-WP-0064`.
+
 ## Repository source identity and provenance
 
 Repo Manager remains authoritative for repository slug, active state,