Bomly CLI v0.16.1

What's Changed

• Remove retired Go Report Card badge by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/226
• Add native Go fuzzing coverage by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/227
• docs: README audit (R3) — no-login framing + inline Action snippet by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/228
• Document Bomly MCP server by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/229
• build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.3.0 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/231
• build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/232
• build(deps): bump actions/setup-node from 5.0.0 to 6.4.0 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/233
• build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/234
• build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/235
• build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in https://github.com/bomly-dev/bomly-cli/pull/236
• Harden Python dependency resolution by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/238
• fix: surface detector fallbacks and add pipeline stage logging by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/239
• feat: request-scoped detector logging and per-ecosystem subproject count by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/240
• Stabilize smoke test dependencies by @bomly-guy in https://github.com/bomly-dev/bomly-cli/pull/241
• test: update smoke golden files by @github-actions[bot] in https://github.com/bomly-dev/bomly-cli/pull/242

Full Changelog: https://github.com/bomly-dev/bomly-cli/compare/v0.16.0...v0.16.1

---

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.