Phase 5: bump flask 3.0.0->3.1.3, SBOM (syft) + scout cross-check + G…

[MetaMaaz]

Phase 5 — supply-chain extras.

• Bumped flask 3.0.0 → 3.1.3 to clear CVE-2026-27205 (LOW, cache-of-sensitive-info) that docker scout flagged but the Trivy CRITICAL/HIGH gate filtered by design.
• Generated an SPDX SBOM with syft (results/sbom.json) — 41 components, no shell / apt / perl, confirming the distroless attack-surface claim.
• Cross-checked with docker scout (results/scout-summary.txt): 0C/0H/0M/0L after the bump. Scout and Trivy disagree on the base-OS DoS CVEs — kept both as a methodology note.
• Published the image to GHCR: ghcr.io/metamaaz/myapp:latest and :v4-distroless.

No Dockerfile changes; image rebuilt and re-scanned clean before publishing.