How SBOM-driven traceability can automate compliance for modern safety-critical open source software.