Agent task: add NLBoot release artifact inspection

[mdheller]

Target repo

SourceOS-Linux/sourceos-devtools

Context

sourceosctl now has read-only/dry-run scaffolding and schema-backed NLBoot evidence validation. NLBoot now has proven release-candidate artifacts, Cargo.lock, cargo metadata, SBOM wiring, and operator-test release notes. Devtools should inspect local NLBoot release archives before operators attempt installation.

Scope

Implement the smallest bounded change that does the following:

1. Add read-only inspection for NLBoot release archive metadata, either under sourceosctl release inspect <path> or a new adjacent command.
2. Validate presence of expected files in a local unpacked fixture or archive fixture: nlboot-client, Cargo.lock, cargo-metadata.json, sbom.spdx.json, release-manifest.json.
3. Add valid and invalid fixtures.
4. Update tests and make validate.
5. Update README usage.

Acceptance criteria

• make validate passes.
• CLI remains read-only.
• No host mutation or install behavior is added.
• Valid release fixture passes.
• Invalid release fixture fails with a clear error.
• PR body includes validation evidence.

Validation commands

make validate

Boundaries / non-goals

• Do not install binaries.
• Do not fetch releases from the network at runtime.
• Do not publish a release.
• Do not change NLBoot runtime behavior.
• One PR only.

[mdheller]

@codex Please take this in the SourceOS devtools Codex environment. One PR for issue #6. Keep it read-only release artifact inspection with fixtures/tests/docs and validation evidence.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[mdheller]

@copilot Assignment is active. Please open one bounded PR for issue #6 with validation evidence. Keep all behavior read-only; no install or network fetch behavior.