Inventory software identity from repository metadata without executing untrusted code. Track provenance, signing, SBOM and readiness evidence.