V3 deterministic local SBOM capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local syft CLI ingredient exposes bounded project operations for readiness and CycloneDX JSON SBOM generation. The scan runs from an explicit project directory cwd supplied at execution time, scans one trusted local target directory, and writes a CycloneDX JSON software bill of materials via the software.sbom_cyclonedx catalog operation. Fixed-function and reproducible: no container registry pulls, no login, no attestation upload, no caller-supplied config/template path, no arbitrary syft flags, no shell wrapper, and no network egress. The SBOM is captured as result.file_ref instead of stdout so large dependency metadata stays behind the Gateway-gated file-ref boundary. Requires syft on PATH (macOS: brew install syft; Linux: install the Anchore syft binary). Local and no-egress.