feat: verify canonical portfolio release provenance

package.json

@@ -31,12 +31,14 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
+    "canonicalize": "2.1.0",
     "three": "^0.185.1",
     "vue": "^3.5.42",
     "zod": "^4.5.4"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.13.0",
+    "@cyclonedx/cyclonedx-npm": "6.0.1",
     "@playwright/test": "^1.62.1",
     "@vitejs/plugin-vue": "^6.0.8",
     "@vue/server-renderer": "^3.5.42",
@@ -45,6 +47,7 @@
     "eslint": "^10.9.1",
     "file-type": "^22.0.2",
     "happy-dom": "^20.12.0",
+    "license-checker-rseidelsohn": "4.4.2",
     "lighthouse": "^13.4.1",
     "prettier": "^3.9.6",
     "sharp": "^0.35.4",