CHW-4321 SBOMFormatUnsupported

Default message: unsupported sbom output format; this server emits CycloneDX only (use ?format=cyclonedx or omit the parameter; for ecosystem filtering use ?ecosystem=npm)
HTTP status: 400 (client)

Problem. GET /api/sbom?format=<value> returned 400. Cause. The caller asked for an output schema this server doesn’t ship. Today the only supported value is cyclonedx (the default when ?format= is omitted). spdx is reserved in the validation slot for a future release; any other value (e.g. ?format=foo) is also rejected. Fix. Drop the parameter to get the default CycloneDX document, or pass ?format=cyclonedx explicitly. For ecosystem filtering (e.g. “give me only the npm components”) use the separate ?ecosystem=npm parameter — prior to Wave-O the ?format= parameter doubled as the ecosystem filter, which silently returned empty SBOMs when callers passed ?format=cyclonedx. Legacy callers passing a known ecosystem name still work but receive a Warning: 299 header pointing at ?ecosystem=. HTTP 400.