feat(retirement): route SBOM scans through repo-manager

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

api/services/repo_manager_dual_run.py

@@ -144,12 +144,12 @@ def record_mutation(
     detail: dict[str, Any] | None = None,
 ) -> None:
     try:
-        from datetime import datetime, timezone
+        from datetime import UTC, datetime
 
         path = meter_path()
         path.parent.mkdir(parents=True, exist_ok=True)
         row = {
-            "ts": datetime.now(timezone.utc).isoformat(),
+            "ts": datetime.now(UTC).isoformat().replace("+00:00", "Z"),
             "source": source,
             "kind": kind,
             "repo_slug": repo_slug,
@@ -409,6 +409,31 @@ def rm_update_register_entry(
     return result
 
 
+def rm_scan_sbom(
+    *,
+    repo_path: str | Path,
+    repo_slug: str | None = None,
+) -> dict[str, Any]:
+    """Derive a versioned SBOM snapshot from repository-owned sources."""
+    args = ["sbom", "scan", "--path", str(repo_path)]
+    if repo_slug:
+        args.extend(["--slug", repo_slug])
+
+    code, out, err = run_rmgr(args)
+    try:
+        result = json.loads(out.strip() or "{}")
+    except json.JSONDecodeError:
+        result = {
+            "ok": False,
+            "error": f"rmgr non-json exit={code} stderr={err!r} stdout={out[:500]!r}",
+        }
+    if code != 0:
+        result.setdefault("ok", False)
+        result.setdefault("error", f"rmgr exit={code} stderr={err!r}")
+    result["exit_code"] = code
+    return result
+
+
 def rm_scaffold(
     *,
     repo_path: str | Path,