refactor(action): replace bash blocks with zero-dependency Node.js modules

Extract ~450 lines of complex bash from action.yaml into modular,
unit-tested Node.js scripts in lib/. All logic is covered by 26 native
node:test unit tests (node --test, no external dependencies).

Modules added:
- lib/platforms.js   - platform parsing and OCI manifest auto-discovery
- lib/distro.js      - SPDX PURL distro detection (os_name/os_version)
- lib/verifier.js    - Trivy arch mapping and SHA256 verification
- lib/diagnostics.js - CI terminal diagnostic formatters
- lib/install-trivy.js  - Trivy install/verify entrypoint (replaces bash step)
- lib/extract-sboms.js  - SBOM extraction entrypoint (replaces bash step)
- lib/scan-sboms.js     - SBOM scan + diff entrypoint (replaces bash step)

Tests added (all pass, auto-discovered by
ode --test):
- test/platforms.test.js
- test/distro.test.js
- test/verifier.test.js
- test/diagnostics.test.js
- test/orchestration.test.js

action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node
scripts via INPUT_* env vars so modules are fully decoupled from the
Actions runner and testable in isolation.

test/orchestration.test.js

@@ -0,0 +1,65 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { parseArgs: parseExtractArgs, cleanupInvalidFile } = require('../lib/extract-sboms.js');
+const { parseArgs: parseScanArgs } = require('../lib/scan-sboms.js');
+
+test('extract-sboms parseArgs parses command line arguments and defaults', () => {
+  const argv = [
+    'node',
+    'extract-sboms.js',
+    '--head-image', 'my-repo/head:1.0',
+    '--target-image', 'my-repo/target:1.0',
+    '--architectures', 'amd64,arm64',
+    '--use-inbuild-sbom', 'true',
+  ];
+
+  const args = parseExtractArgs(argv);
+  assert.equal(args.headImage, 'my-repo/head:1.0');
+  assert.equal(args.targetImage, 'my-repo/target:1.0');
+  assert.equal(args.architectures, 'amd64,arm64');
+  assert.equal(args.useInbuildSbom, 'true');
+});
+
+test('extract-sboms cleanupInvalidFile removes empty files and files containing null', () => {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbom-clean-'));
+  const emptyFile = path.join(tmpDir, 'empty.json');
+  const nullFile = path.join(tmpDir, 'null.json');
+  const validFile = path.join(tmpDir, 'valid.json');
+
+  fs.writeFileSync(emptyFile, '');
+  fs.writeFileSync(nullFile, 'null\n');
+  fs.writeFileSync(validFile, '{"spdxVersion": "SPDX-2.3"}');
+
+  cleanupInvalidFile(emptyFile);
+  cleanupInvalidFile(nullFile);
+  cleanupInvalidFile(validFile);
+
+  assert.equal(fs.existsSync(emptyFile), false);
+  assert.equal(fs.existsSync(nullFile), false);
+  assert.equal(fs.existsSync(validFile), true);
+
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+
+test('scan-sboms parseArgs parses scan arguments and defaults', () => {
+  const argv = [
+    'node',
+    'scan-sboms.js',
+    '--head-image', 'my-head:latest',
+    '--target-image', 'my-target:latest',
+    '--target-branch', 'feature',
+    '--output-delta', 'custom-delta.md',
+    '--output-summary', 'custom-summary.md',
+  ];
+
+  const args = parseScanArgs(argv);
+  assert.equal(args.headImage, 'my-head:latest');
+  assert.equal(args.targetImage, 'my-target:latest');
+  assert.equal(args.targetBranch, 'feature');
+  assert.equal(args.outputDelta, 'custom-delta.md');
+  assert.equal(args.outputSummary, 'custom-summary.md');
+  assert.equal(args.useInbuildSbom, 'false');
+});