Separate SBOM from dist/ so PyPI publish stops choking on it

The 2.1.0 publish run failed because dist/bitmath-2.1.0.cdx.json was
bundled into the dist artifact uploaded to PyPI. twine globs every file
in packages-dir and rejected the SBOM with
"InvalidDistribution: Unknown distribution format". The prior comment
("Keep the SBOM out of the PyPI upload") captured the intent but the
implementation never separated the file.

Generate the SBOM into sbom/, upload it as its own artifact, download
it separately in the publish job, and attach it to the GitHub release
from there. dist/ now contains only wheels and sdists.

Author: timlnx

.github/workflows/publish.yml

@@ -22,17 +22,23 @@ jobs:
         run: |
           pip install cyclonedx-bom
           VERSION=$(cat VERSION)
+          mkdir -p sbom
           python -m venv /tmp/sbom-env
           /tmp/sbom-env/bin/pip install --upgrade pip
           /tmp/sbom-env/bin/pip install --no-deps dist/*.whl
           cyclonedx-py environment /tmp/sbom-env/bin/python \
             --output-format JSON \
-            --output-file "dist/bitmath-${VERSION}.cdx.json"
+            --output-file "sbom/bitmath-${VERSION}.cdx.json"
       - name: Upload dist artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist/
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom
+          path: sbom/
 
   publish:
     needs: build
@@ -47,15 +53,19 @@ jobs:
         with:
           name: dist
           path: dist/
+      - name: Download SBOM artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sbom
+          path: sbom/
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
-          # Keep the SBOM out of the PyPI upload; it ships on the GitHub release instead.
           packages-dir: dist/
           skip-existing: false
       - name: Attach SBOM to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           TAG="${GITHUB_REF#refs/tags/}"
-          gh release upload "$TAG" dist/bitmath-*.cdx.json --clobber --repo "$GITHUB_REPOSITORY"
+          gh release upload "$TAG" sbom/bitmath-*.cdx.json --clobber --repo "$GITHUB_REPOSITORY"