Docs: document how vg sbom treats multiple versions of the same component

[vibgrate-team]

Context

Real monorepos often resolve multiple versions of the same package. Adjacent CycloneDX CLIs expose analyze flags for multiple component versions; Vibgrate contributors need a clear answer: does vg sbom emit one component per version, merge them, or pick a winner — and is that choice deterministic?

What to do

1. Observe current vg sbom behavior on a tiny fixture with two versions of one package (e.g. nested npm deps).
2. Document the rule in SBOM docs: identity key (name + version + purl), ordering, and what consumers should expect.
3. Link to related PURL work (Bug: emit ecosystem-correct PURLs in SBOM exports #167) without duplicating it — this ticket is multi-version presence, not PURL correctness.
4. If behavior is surprising, note it as a known limitation rather than quietly changing exporters in a docs PR.

Acceptance

• Docs state how multiple versions appear in SBOM output
• Example uses vg and a minimal fixture description
• Determinism / stable ordering called out where relevant
• DCO sign-off on commits (git commit -s) if the PR touches the repo

Mentoring notes

Stay documentation-first. A behavior change belongs in a separate enhancement with tests.