📦 Add cargo-cyclonedx SBOM tool 📦

- Dockerfile: add cargo-cyclonedx to the per-tool binstall loop, alongside
  the existing cargo-audit/cargo-deny/cargo-geiger security tools. Verified
  installed at /usr/local/bin/cargo-cyclonedx (v0.5.9) and confirmed it
  generates a valid CycloneDX 1.3 SBOM (cargo cyclonedx) from a real crate
  inside the built image.
- Dockerfile: LABEL org.opencontainers.image.url/source corrected to
  hub.docker.com and github.com/dockersrc/rust respectively (external edit,
  present in the working tree, not reverted).
- README.md: document cargo-cyclonedx in the linting & static analysis
  tool table.
- AI.md: replaced with the new master CasjaysDev Docker base image spec —
  the bootstrap/update runbook now lives in the dockersrc-bootstrap agent
  instead of this file (external edit, present in the working tree, not
  reverted).

Dockerfile

@@ -104,6 +104,7 @@ RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local
       bacon \
       cargo-audit \
       cargo-deny \
+      cargo-cyclonedx \
       cargo-machete \
       cargo-semver-checks \
       cargo-make \
@@ -350,10 +351,10 @@ LABEL org.opencontainers.image.authors="${LICENSE}"
 LABEL org.opencontainers.image.created="${BUILD_DATE}"
 LABEL org.opencontainers.image.version="${BUILD_VERSION}"
 LABEL org.opencontainers.image.schema-version="${BUILD_VERSION}"
-LABEL org.opencontainers.image.url="https://docker.io/casjaysdev/rust"
+LABEL org.opencontainers.image.url="https://hub.docker.com/r/casjaysdev/rust"
 LABEL org.opencontainers.image.vcs-type="Git"
 LABEL org.opencontainers.image.revision="${GIT_COMMIT}"
-LABEL org.opencontainers.image.source="https://docker.io/casjaysdev/rust"
+LABEL org.opencontainers.image.source="https://github.com/dockersrc/rust"
 LABEL org.opencontainers.image.documentation="https://github.com/dockersrc/rust"
 LABEL com.github.containers.toolbox="false"
 

README.md

@@ -181,6 +181,7 @@ Run miri with: `cargo +nightly miri test`
 | `cargo-geiger` | Counts `unsafe` blocks and dependencies — reports unsafe surface area |
 | `cargo-deny` | Policy enforcement — license allow-lists, ban crates, advisories |
 | `cargo-audit` | Scan `Cargo.lock` against the RustSec advisory DB |
+| `cargo-cyclonedx` | Generate a CycloneDX SBOM from `Cargo.lock` |
 | `cargo-machete` | Detect unused dependencies (stable) |
 | `cargo-udeps` | Detect unused dependencies (nightly; `cargo +nightly udeps`) |
 | `cargo-hack` | Test all feature flag combinations to catch cfg-gated bugs |