xz utils

After xz: A Practical Supply-Chain Checklist for Solo and Small Teams

Turn the xz-utils backdoor lesson into action: tarball vs git diffs, SBOM, Sigstore Cosign, SLSA provenance, and a solo/small-team release gate you can run this week.