[atx-omni]

Summary

• Consolidate Bump idna from 3.19 to 3.20 #29, Bump charset-normalizer from 3.5.1 to 3.5.2 #33, and Bump anchore/sbom-action from 0.24.2 to 0.24.3 #34: idna 3.20, charset-normalizer 3.5.2, and the reviewed full-SHA SBOM Action 0.24.3 pin.
• Preserve both Python dependency upgrades and their verified hashes in the shared lockfile; retain setuptools 84 and the urllib3 floor.
• Explicitly disable release-asset uploads in the read-only SBOM build step. The existing protected publishing job retains sole release publication authority.
• Add a focused regression check covering the upload opt-out, read-only build permissions, and protected tag-only publisher.

Verification

• Focused client, transport, repository-hardening, release-candidate, and documentation checks pass locally.
• The final runtime lock is byte-identical to the reviewed combined lock, whose Linux hashes, package build/install, startup, and dependency consistency passed.
• Required hosted CI must pass before merge; after final-main CI, run the existing non-publishing release preflight.

Replaces #29, #33, and #34 after merge; those PRs will remain open until this replacement is successfully merged. No production tenant calls, release publication, or repository protection changes are included.

[atx-omni]

Post-merge release verification completed on final ExploreOmni main cfee053 after documentation PR #32 merged. The exact-main verifier confirmed successful Test, Dependency Scan, Actions Security, SAST, and Secret Scan workflows and required jobs. Manual release preflight https://github.com/exploreomni/OmniFlow/actions/runs/38854198466 succeeded: build and signing passed, signed bundle uploaded, and publish-github was skipped. The GitHub releases inventory remains empty; no tag or release was created. Superseded PRs #29, #33, and #34 are closed. The same source tree has also been merged into ATX via atx-omni/OmniFlow#33; final ATX main-push verification is being completed separately.