docs: clarify empty Hub mirror and canonical energy-attest source

Add per-repo CycloneDX BOM (canonical registry: datasets/SZLHOLDINGS/model-bom)

Add honest kernel card: canonical GitHub source, doctrine labels

initial commit