bug: tighten permissive cases in release_bom.validate_bom

[codeforester]

Goal

Close gaps where cli/python/base_release/release_bom.py::validate_bom
accepts semantically inconsistent BOM documents.

Background

From the 2026-09-09 deep review of the release-BOM feature (Base 1.9.0). None
of these is exploited by the current Ecosystem Release BOM workflow (which
builds rows consistently via jq and bin/base-release-bom-row), but
validate_bom is the contract of record and is invoked directly by
bin/base-release-bom validate and by basectl release check/publish --bom.

1. Component tag is checked against TAG_RE but never against
   v{component.version}. release.tag is cross-checked
   (release_bom.py ~line 49); component rows are not.
2. The release repository's own component row commit is not checked against
   release.commit; they may diverge.
3. combinations[].platform is a free string and is not required to appear in
   any participant's platforms array.
4. release.version (and component version) are validated only as
   non-empty strings, while release.tag must match ^v[0-9]+\.[0-9]+\.[0-9]+$
   and equal v<version> -- so release.version = "01.9.0" slips through.
5. REPOSITORY_RE = ^[^/\s]+/[^/\s]+$ accepts values such as ../foo.

Scope

• cli/python/base_release/release_bom.py::validate_bom:
  • non-moving component rows: require tag == f"v{version}".
  • the component row whose repository equals release.repository: require
    commit == release.commit.
  • each combinations[].platform: require it to be listed by every
    participant's component platforms (or by at least one -- decide and
    document the rule).
  • apply strict SemVer to release.version and component version.
  • tighten REPOSITORY_RE to reject . / .. path segments.
• docs/schemas/release-bom.schema.json and docs/release-bom.md: reflect
  the tightened rules (coordinate with the schema-reconciliation issue).
• cli/python/base_release/tests/test_release_bom.py: a dedicated failing
  test for each of the five items.

Acceptance Criteria

• Each of the five inconsistencies has a dedicated test and is rejected
  by validate_bom with a clear message.
• tests/fixtures/release-bom-valid.json and a CI-assembled BOM still
  validate.
• Schema and docs/release-bom.md updated to match, or the
  schema-reconciliation harness enforces the agreement.

Validation

python -m pytest cli/python/base_release/tests/test_release_bom.py -q
bin/base-release-bom validate tests/fixtures/release-bom-valid.json \
  --repository basefoundry/base-bash-libs --version 2.1.0
bin/base-test

Non-Goals

• No new required or optional BOM fields.
• No schema_version bump unless the schema-reconciliation issue concludes
  one is required.
• Not changing how the workflow assembles rows (covered by the workflow
  hardening issue).

Project Fields

• Status: Backlog
• Priority: P3
• Size: S
• Area: Packaging
• Initiative: Contract Hardening
• Milestone: v1.10.0

Agent Assignment

Human first; Copilot candidate after triage once the combinations[].platform
rule (all vs any participant) is decided.