Enhancement: stable merge + clear warnings when vg sbom consumes multiple input SBOMs

[vibgrate-team]

Context

Adjacent SBOM ecosystems often struggle with BOM-of-BOM / multi-BOM upload semantics (duplicate components, dropped namespaces, unstable order). If vg sbom can accept or merge more than one input document, merges must stay deterministic and emit clear, actionable warnings when identities collide — never silent drops.

What to do

1. Define/confirm merge precedence (first-wins vs severity vs explicit flag) and stable component ordering.
2. When duplicate PURLs/versions collide, emit a machine-readable warning/finding rather than omitting quietly.
3. Add a small fixture with two overlapping SBOMs and assert stable output + warning presence.

Acceptance

• Multi-input merge is deterministic across runs
• Collisions are visible (warning/finding), not silent
• Tests + DCO; local-first (no registry auth required for the fixture)