fix(sbom): mark v1.1 main as development

[stacknil]

Summary

• Change sbom-diff-and-risk package/runtime metadata to 1.1.0.dev0.
• Regenerate the SARIF version evidence for the development build.
• Keep the public stable-release assertions at v1.0.0 while testing the separate main-development version.

Why

main contains unreleased v1.1 identity and policy semantics, but package metadata and SARIF evidence still identified those builds as the published v1.0.0 release.

How to validate

• python -m pytest from tools/sbom-diff-and-risk — 220 passed.
• python -m ruff check src/sbom_diff_risk/__init__.py tests/test_release_workflow.py — passed.
• python scripts/regenerate-example-artifacts.py --check — all checked examples current.
• python scripts/validate-reviewer-routes.py from repository root — passed.
• python -m build tools/sbom-diff-and-risk --outdir tools/sbom-diff-and-risk/.tmp-version-drift-dist — produced 1.1.0.dev0 wheel and sdist.

Risk / rollout notes

• Design decision: keep v1.0.0 as the documented stable release while main and generated SARIF identify themselves as 1.1.0.dev0.
• Main risk: consumers comparing golden SARIF byte-for-byte will see the intentional driver-version change.
• Compatibility impact: no CLI, schema, identity, or policy behavior changes in this PR; only version metadata and generated version evidence change.
• Rollback path: revert commit 49138f7 to restore v1.0.0 metadata and SARIF evidence.
• Known unrelated check: full-tree ruff check . currently reports seven pre-existing issues outside this diff; the changed Python files pass Ruff.

[stacknil]

Post-CI diff review complete.

• Design decision: keep the published stable line at v1.0.0 while package/runtime/SARIF evidence on main uses 1.1.0.dev0.
• Main risk: byte-for-byte SARIF consumers will observe the intentional driver-version change.
• Compatibility impact: no CLI, schema, identity, or policy behavior changes; version metadata only.
• Rollback path: revert 49138f7.

All required PR checks passed, the remote diff is limited to seven expected files, and git diff --check is clean. No bot or reviewer comments were present.