docs: anchor legal claims to official sources and fix plan limits

[vpetersson]

Summary

Three accuracy fixes that came out of a claims audit against official legal sources and the app/action codebases:

Homepage (content/_index.html)

• EO 14028 line corrected. The old copy claimed EO 14028 "requires SBOMs for federal procurement." Per our own /compliance/eo-14028/ page, OMB M-26-05 (Jan 2026) rescinded M-22-18/M-23-16 and made attestation optional. The new copy says EO 14028 kicked off federal SBOM adoption and remains in effect, with agencies encouraged to require SBOMs contractually, and links internally to the sourced compliance page.
• Post-quantum/CBOM angle added. EO 14144's PQC provisions survived EO 14306 (June 2025): the CISA PQC product-categories list (published Jan 23, 2026) and the TLS 1.3 mandate by January 2030. Framed honestly as "you can't migrate cryptography you haven't inventoried," linking to the CBOM FAQ. No EO requires CBOMs, and the copy doesn't claim one does.
• The €15M / 2.5% CRA fine figure now links to the new penalties section below.

CRA compliance page (content/compliance/eu-cra.md)

• New "Penalties (Article 64)" section, verified against the Official Journal text of Regulation (EU) 2024/2847 (via the EU Publications Office): the three fine tiers (Art 64(2)-(4)), the sizing factors (64(5)), the Article 64(10) derogations for microenterprises and open-source software stewards, and a timing note tied to Article 71. The fine figure quoted on the homepage previously had no citation anywhere on the site.

Pricing page (content/pricing.html)

• Component limits corrected to match the app's enforcement. The app enforces components as a flat per-workspace total (max_components in apps/billing/migrations/0002_billing_plans_data.py, enforced team-wide in billing_processing.py): 5 on Community and 200 on Business. The page claimed "20 Components per Product" (implying 100). Now reads "5 Components" / "200 Components."

Verification

• All other pricing-page claims were verified against the sbomify app code (prices, trial length, scan cadences, plan gating) and all sbomify-action claims against its repo (wizard, standalone mode, 12 enrichment sources, attestation, license) — no other discrepancies found.
• dprint markdown formatting applied. Hugo build not run locally (no local Hugo); relying on the lint workflow's build + lychee link check.

🤖 Generated with Claude Code