Fix CycloneDX SBOM attestation for v0.3.1

[masarray]

Root cause

The tagged v0.3.1 workflow successfully built and validated both portable applications, the installer, portable ZIP, CycloneDX SBOM, checksums, silent install/uninstall, and build-provenance attestation. Publication stopped only at the SBOM-attestation step.

actions/attest@v4 recognizes a CycloneDX document only when bomFormat, specVersion, and serialNumber are present. The generated ARSVIN SBOM omitted serialNumber, so the action rejected it before the GitHub Release step.

Changes

• Generate a deterministic RFC 4122 UUID URN as CycloneDX serialNumber from repository identity, release version, and source commit.
• Keep the SBOM repeatable for the same version and commit.
• Bump the repository-owned SBOM generator metadata to 1.2.0.
• Validate the UUID URN format before installer artifacts are uploaded.
• Validate that the SBOM component version matches the workflow release version.
• Print the validated serial number in workflow evidence.

Required validation

• CI and CodeQL must remain green.
• Full Windows release validation must regenerate portable EXEs, installer, ZIP, SBOM, checksums, and pass silent install/uninstall.
• The PR release job must remain skipped.
• After merge, the unpublished v0.3.1 tag will be moved to the corrected main commit and the tag workflow will be run once to publish the release.

No existing GitHub Release is overwritten because v0.3.1 has not been published.