Add GitHub scanner and ai-bom-like CLI/profile ergonomics

[akumar0205]

Motivation

• Provide a first-class GitHub scanning workflow so AIBOM can scan many repos (shallow clone, CI-friendly) and produce aggregated human- and machine-readable summaries.
• Offer an opt-in ai-bom-style presentation profile so users get concise executive summaries and a terminal-friendly UX without breaking the canonical AIBOM schema.
• Preserve the repo's standards-first strengths (SPDX/CycloneDX/SARIF/VEX, drift detection, attest) and keep security defaults (redaction, safe-path validation, explicit prompt acknowledgement).

Description

• Added a new orchestration module aibom/github_scan.py which implements scan_github_repos() with shallow clone support, repo file ingestion, per-repo output folders, aggregate summary.json + SUMMARY.md, dataclass RepoScanRecord, gate enforcement (--fail-on, --max-high-risk, --max-unsupported), and robust partial-failure continuation semantics.
• Added aibom/presentation.py which builds a deterministic ai-bom-like companion profile (*_ai_profile.json), renders concise text summaries, and produces markdown summary tables for aggregated runs.
• Extended CLI in aibom/cli.py to add scan-github (with --repo, --repos-file, --branch, --depth, --token-env, --max-repos, --timeout-sec, etc.), --profile on generate and scan-github (choices canonical|ai-bom-like), and summarize --input for rendering ai-bom-like text or JSON outputs.
• Updated docs, examples, and CI workflow: .github/workflows/aibom.yml (PR drift gate + scheduled multi-repo scan + artifact upload), README.md (quickstart + migration notes), docs/GITHUB_SCANNER_GUIDE.md, and examples/github_repo_samples/repos.txt.

Testing

• Ran linting and formatting checks: ruff check . passed and black --check . passed after formatting updates.
• Ran the full test suite with local import path: PYTHONPATH=. pytest -q which passed: 52 passed.
• Attempted installation with pip install -e . which failed in this environment due to external package index/proxy restrictions (error: unable to fetch build dependencies such as setuptools), so tests were executed with PYTHONPATH=. instead.
• Executed a demo scan command: PYTHONPATH=. python -m aibom.cli scan-github --repo openai/openai-quickstart-python --output-dir out --profile ai-bom-like which returned nonzero due to network/proxy preventing git clone (clone error/exit status 128) but the scanner exercised error aggregation and produced out/summary.json and out/SUMMARY.md as designed.

Files added/changed (high level): aibom/github_scan.py, aibom/presentation.py, aibom/cli.py (new commands and profile flag), small fixes in aibom/bundle.py and aibom/utils.py for path/cert handling and lint hygiene, new docs docs/GITHUB_SCANNER_GUIDE.md, updated .github/workflows/aibom.yml, README.md, examples/github_repo_samples/repos.txt, and new/updated tests and fixtures under tests/ to cover profile rendering and GitHub scan behaviors.

Behavioral differences vs ai-bom and rationale

• ai-bom-like output is opt-in via --profile ai-bom-like and writes a companion presentation JSON rather than replacing the canonical AIBOM schema to preserve backward compatibility for existing consumers.
• scan-github is batch-oriented and CI-friendly: it continues on per-repo errors and emits aggregated summary.json + SUMMARY.md while returning a nonzero exit code when any configured gates fail, which improves observability in CI workflows and supports partial success scenarios.
• Drift/risk gates align with AIBOM's existing gate semantics (new-model,new-tool,new-external-provider + thresholds) to retain the repo's policy model rather than verbatim external semantics.

---

Codex Task