[codex] Harden release and install guidance

[jasoncrites]

Hardens Bumblebee's release and install guidance.

What changed:

• Pin govulncheck in CI instead of installing it from @latest.
• Replace the README's unpinned install example with a tagged release install.
• Add SBOM generation to the GoReleaser archive artifacts.
• Add a regression test that enforces those policy constraints.

Why:

• Remove live install provenance from CI and docs.
• Make release artifacts more auditable with checksums and SBOMs.

Checks:

• go test ./cmd/bumblebee ./...
• git diff --check