ci(release): make SBOM generation non-blocking

Author: ReverseZoom2151

.github/workflows/release.yml

@@ -190,12 +190,17 @@ jobs:
 
       - name: Generate CycloneDX SBOM
         # Software Bill of Materials attached to every release. CycloneDX 1.5 JSON.
-        # --legacy-peer-deps: Gordon builds with Bun, which does not enforce
-        # peer ranges, and one transitive SDK still pins an older `ai` major.
-        # npm's strict peer resolution would fail this lockfile-only pass; the
-        # flag keeps SBOM generation working without changing what ships.
+        #
+        # Gordon installs with Bun, so the dependency tree npm sees will always
+        # look inconsistent to it (npm reports every peer range Bun does not
+        # enforce as missing/invalid). That is a reporting artifact, not a
+        # broken tree: the shipped binary is built from bun.lock. The refresh is
+        # therefore best-effort and the whole step is non-blocking, since the
+        # SBOM is a release attachment and must never gate a release.
+        continue-on-error: true
         run: |
-          npm install --package-lock-only --ignore-scripts --legacy-peer-deps
+          npm install --package-lock-only --ignore-scripts --legacy-peer-deps \
+            || echo "npm lockfile refresh reported peer issues; continuing (bun.lock is the source of truth)"
           node scripts/dev/codegen/generate-sbom.cjs --output gordon-sbom.json
 
       - name: Create or update GitHub Release