feat(release): enforce aligned trusted publications

tools/checks/check-release-integration.sh

@@ -92,6 +92,7 @@ install_cloned_webui_dependencies() {
 }
 
 run_step "Validate release refs and installed package metadata"
+"$PYTHON" "$META_ROOT/tools/checks/check-version-alignment.py" --release-composition
 "$PYTHON" "$META_ROOT/tools/checks/check-contracts.py" --no-impact
 "$PYTHON" - <<'PY'
 from __future__ import annotations
@@ -208,6 +209,12 @@ snapshot = registry.validate()
 print("Registry modules:", ", ".join(manifest.id for manifest in snapshot.manifests))
 PY
 
+run_step "Generate release dependency provenance"
+"$PYTHON" "$META_ROOT/tools/release/generate-release-sbom.py" \
+  --python "$PYTHON" \
+  --core-root "$ROOT" \
+  --output "$WORK_ROOT/govoplan-sbom.cdx.json"
+
 run_step "Run SQLite migration smoke for release modules"
 "$PYTHON" - <<'PY'
 from __future__ import annotations