SC8)

Golden payloads: sample-cdx17-cbom.json, downgraded sample-cdx16.json, with hashes.txt (BLAKE3, SHA256).
Must include CVSS v4 + v3.1 ratings, CBOM ingress/egress, evidence properties, SLSA Source Track fields.
Used by determinism CI to assert stable ordering/hashes.