refactor(action): replace bash blocks with zero-dependency Node.js modules

Extract ~450 lines of complex bash from action.yaml into modular,
unit-tested Node.js scripts in lib/. All logic is covered by 26 native
node:test unit tests (node --test, no external dependencies).

Modules added:
- lib/platforms.js   - platform parsing and OCI manifest auto-discovery
- lib/distro.js      - SPDX PURL distro detection (os_name/os_version)
- lib/verifier.js    - Trivy arch mapping and SHA256 verification
- lib/diagnostics.js - CI terminal diagnostic formatters
- lib/install-trivy.js  - Trivy install/verify entrypoint (replaces bash step)
- lib/extract-sboms.js  - SBOM extraction entrypoint (replaces bash step)
- lib/scan-sboms.js     - SBOM scan + diff entrypoint (replaces bash step)

Tests added (all pass, auto-discovered by
ode --test):
- test/platforms.test.js
- test/distro.test.js
- test/verifier.test.js
- test/diagnostics.test.js
- test/orchestration.test.js

action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node
scripts via INPUT_* env vars so modules are fully decoupled from the
Actions runner and testable in isolation.

test/distro.test.js

@@ -0,0 +1,81 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { detectDistro } = require('../lib/distro.js');
+
+test('detectDistro returns null for null, undefined, or empty input', () => {
+  assert.equal(detectDistro(null), null);
+  assert.equal(detectDistro(undefined), null);
+  assert.equal(detectDistro(''), null);
+  assert.equal(detectDistro('{}'), null);
+});
+
+test('detectDistro extracts distro from parsed SPDX object with package PURLs', () => {
+  const spdx = {
+    packages: [
+      {
+        name: 'acl',
+        externalRefs: [
+          {
+            referenceType: 'purl',
+            referenceLocator: 'pkg:deb/debian/acl@2.3.1-3?os_distro=bookworm&os_name=debian&os_version=12',
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(detectDistro(spdx), 'debian/12');
+});
+
+test('detectDistro extracts distro from JSON string containing escaped unicode \\u0026', () => {
+  const jsonStr = JSON.stringify({
+    packages: [
+      {
+        name: 'adduser',
+        externalRefs: [
+          {
+            referenceType: 'purl',
+            referenceLocator: 'pkg:deb/debian/adduser@3.134?os_distro=bullseye&os_name=debian&os_version=11',
+          },
+        ],
+      },
+    ],
+  }).replace(/&/g, '\\u0026');
+
+  assert.ok(jsonStr.includes('\\u0026'));
+  assert.equal(detectDistro(jsonStr), 'debian/11');
+});
+
+test('detectDistro handles non-debian distributions (e.g. ubuntu, alpine)', () => {
+  const spdx = {
+    packages: [
+      {
+        externalRefs: [
+          {
+            referenceType: 'purl',
+            referenceLocator: 'pkg:apk/alpine/alpine-baselayout@3.4.3-r2?os_name=alpine&os_version=3.20',
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(detectDistro(spdx), 'alpine/3.20');
+});
+
+test('detectDistro returns null when PURLs lack os_name or os_version', () => {
+  const spdx = {
+    packages: [
+      {
+        externalRefs: [
+          {
+            referenceType: 'purl',
+            referenceLocator: 'pkg:generic/foo@1.0.0',
+          },
+        ],
+      },
+    ],
+  };
+
+  assert.equal(detectDistro(spdx), null);
+});