## Why

The gateway has reproducible Linux binaries and a dependency inventory but no deterministic standard SBOM, while OPS-009 and the Phase 3C gateway plan require one for engineering exit.

## What Changes

- Generate byte-stable SPDX 2.3 JSON using repository, Go module, and artifact metadata.
- Record exact source revision, immutable Protocol version/checksum, module relationships, Linux artifact hashes and architectures, and truthful license fields.
- Retain notices/provenance and use `NOASSERTION` where license evidence is unavailable.
- Keep vulnerability scanning, signing, and Phase 3C-C image remediation explicitly separate.

## Capabilities

### New Capabilities

None.

### Modified Capabilities

- `gateway-deployment-artifact`: Require an inspected deterministic standard SBOM for shipped gateway binaries.

## Impact

Data Plane packaging tooling, deterministic tests, Makefile targets, canonical deployment-artifact OpenSpec, and evidence records. Uses Go standard library only; no new dependency. Requirements: SYS-019, P3C-002, P3C-035, OPS-009, VER-015, VER-017.