v0.1.2 fix: collocate SBOMs under single 'auth' generic package so the release-create linker reaches them. v0.1.1 had three SBOMs scattered across per-service packages; the Release page's portal-container.sbom.json link pointed at an empty path. No code changes since v0.1.1 — just the CI packaging fix.