Add an SBOM, and fix the torch randomness nits (L4, L5)

L5: dependency-audit.yml now generates a CycloneDX SBOM from
requirements.lock and uploads it. pip-audit answers "are there known CVEs
today"; an SBOM answers "which exact versions were in this build", which is
the question that arises when something is disclosed later against a release
already in the wild.

Verified against the real tool rather than written from memory -- the first
flag spelling (--output-format / --outfile) does not exist in cyclonedx-py
and would have failed in CI. The working form is
`--of json --output-reproducible -o <file>`, which emits CycloneDX 1.6 with
96 components and records [email protected], [email protected],
[email protected], [email protected], [email protected], [email protected] and
[email protected].0 at exact versions.

L4: torch/services/memory/index.js built its temp filename from Date.now()
plus Math.random() before an atomic rename -- predictable enough to
pre-create or symlink between the write and the rename. Now randomBytes(8).

Also renames the Math.random-derived value in relay-health.mjs from `nonce`
to `probeSuffix` and draws it from randomBytes(6). It is a public probe tag
used to correlate a publish with its readback, not a cryptographic nonce,
and nothing was wrong with it -- but the name invited someone to copy the
pattern somewhere it would matter.

torch has no test/ directory in the repo, so there is no suite to run for
these two files; both were syntax-checked and confirmed to import cleanly.
The SeedPass determinism gate is green (84 tests).

Not done, and recorded as a decision in TODO.md instead: torch/_backups/
holds 5240 tracked files across six dated snapshots. Untracking them is a
large deletion and not something to do as a side effect of an entropy audit.
They currently duplicate every security-relevant grep hit, and bare
`node --test` in torch/ discovers them and fails 18 tests from stale
snapshot code.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01HtNMsKzzFTPURemX7tT19u

docs/entropy_audit_2026-07-31.md

@@ -352,7 +352,27 @@ should be narrowed to the specific exceptions each path can raise.
 
 ---
 
-### L4 — `torch/` subsystem
+### L4 — `torch/` subsystem — **PARTLY DONE 2026-07-31**
+
+Fixed: the temp filename in `services/memory/index.js` now uses
+`randomBytes(8)` instead of `Date.now()` + `Math.random()`, and the
+`Math.random`-derived value in `relay-health.mjs` that was called a `nonce` is
+renamed `probeSuffix` and drawn from `randomBytes(6)` — it is a public probe
+tag, but the name invited reuse of the pattern somewhere it would matter.
+
+**Still open, and it needs a decision:** `torch/_backups/` holds **5240 tracked
+files** across six dated snapshots. Untracking them is a large deletion, so it
+is not something to do as a side effect of an entropy audit. Two concrete costs
+today: they duplicate every security-relevant grep hit, and bare `node --test`
+in `torch/` discovers them and fails 18 tests from stale snapshot code. (The
+`npm test` script uses explicit paths, so CI is unaffected.)
+
+Separately noted: `torch/` has **no `test/` directory in the repo at all**, so
+`npm test` there cannot run as written. Out of scope here, but worth knowing.
+
+The original note follows.
+
+### L4 (original) — `torch/` subsystem
 
 - `torch/src/services/memory/index.js:60` builds a temp filename from
   `Date.now()` + `Math.random()` before an atomic rename. Predictable name;
@@ -368,7 +388,20 @@ should be narrowed to the specific exceptions each path can raise.
 
 ---
 
-### L5 — No SBOM
+### L5 — No SBOM — **DONE 2026-07-31**
+
+`dependency-audit.yml` now generates a CycloneDX SBOM from `requirements.lock`
+and uploads it. Verified locally with the real tool rather than assumed: the
+first flag spelling I wrote (`--output-format` / `--outfile`) does not exist in
+`cyclonedx-py` and would have failed in CI. The working form is
+`--of json --output-reproducible -o <file>`, which emits CycloneDX 1.6 with 96
+components and records the crypto chain at exact versions — `[email protected]`,
+`[email protected]`, `[email protected]`, `[email protected]`, `[email protected]`,
+`[email protected]`, `[email protected]`.
+
+The original note follows.
+
+### L5 (original) — No SBOM
 
 `dependency-audit.yml` and `release-integrity.yml` cover part of §11/§12, but
 no workflow emits a dependency manifest artifact. Add CycloneDX generation