refactor(action): replace bash blocks with zero-dependency Node.js modules

Extract ~450 lines of complex bash from action.yaml into modular,
unit-tested Node.js scripts in lib/. All logic is covered by 26 native
node:test unit tests (node --test, no external dependencies).

Modules added:
- lib/platforms.js   - platform parsing and OCI manifest auto-discovery
- lib/distro.js      - SPDX PURL distro detection (os_name/os_version)
- lib/verifier.js    - Trivy arch mapping and SHA256 verification
- lib/diagnostics.js - CI terminal diagnostic formatters
- lib/install-trivy.js  - Trivy install/verify entrypoint (replaces bash step)
- lib/extract-sboms.js  - SBOM extraction entrypoint (replaces bash step)
- lib/scan-sboms.js     - SBOM scan + diff entrypoint (replaces bash step)

Tests added (all pass, auto-discovered by
ode --test):
- test/platforms.test.js
- test/distro.test.js
- test/verifier.test.js
- test/diagnostics.test.js
- test/orchestration.test.js

action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node
scripts via INPUT_* env vars so modules are fully decoupled from the
Actions runner and testable in isolation.

test/platforms.test.js

@@ -0,0 +1,47 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { parsePlatforms, discoverPlatforms, toArchTag } = require('../lib/platforms.js');
+
+test('parsePlatforms handles empty and undefined input', () => {
+  assert.deepEqual(parsePlatforms(''), []);
+  assert.deepEqual(parsePlatforms(null), []);
+  assert.deepEqual(parsePlatforms(undefined), []);
+  assert.deepEqual(parsePlatforms('   '), []);
+});
+
+test('parsePlatforms parses comma-separated architectures and adds linux/ prefix if omitted', () => {
+  const result = parsePlatforms('amd64, arm64, linux/arm/v7');
+  assert.deepEqual(result, ['linux/amd64', 'linux/arm64', 'linux/arm/v7']);
+});
+
+test('discoverPlatforms extracts unique architectures from OCI image manifests', () => {
+  const headManifest = JSON.stringify({
+    manifests: [
+      { platform: { architecture: 'amd64', os: 'linux' } },
+      { platform: { architecture: 'arm64', os: 'linux' } },
+      { platform: { architecture: 'unknown', os: 'unknown' } },
+    ],
+  });
+
+  const targetManifest = JSON.stringify({
+    manifests: [
+      { platform: { architecture: 'amd64', os: 'linux' } },
+      { platform: { architecture: 'arm', os: 'linux', variant: 'v7' } },
+    ],
+  });
+
+  const result = discoverPlatforms(headManifest, targetManifest);
+  assert.deepEqual(result, ['linux/amd64', 'linux/arm/v7', 'linux/arm64']);
+});
+
+test('discoverPlatforms safely handles invalid or missing manifest JSON', () => {
+  assert.deepEqual(discoverPlatforms('invalid json', null), []);
+  assert.deepEqual(discoverPlatforms('', '{}'), []);
+});
+
+test('toArchTag converts platform strings to filesystem-safe arch tags', () => {
+  assert.equal(toArchTag('linux/amd64'), 'amd64');
+  assert.equal(toArchTag('linux/arm64'), 'arm64');
+  assert.equal(toArchTag('linux/arm/v7'), 'arm-v7');
+  assert.equal(toArchTag('amd64'), 'amd64');
+});