docs: add blog post on ENISA healthcare procurement guidelines

[vpetersson]

Summary

Adds a new blog post (authored as Cowboy Neil, dated 2026-07-23) covering ENISA's July 2026 Procurement guidelines for the cybersecurity of hospitals and healthcare providers.

Angle: the 69-page document never uses the word "SBOM," yet its core supplier-facing measures describe one:

• SOURCE-06: supplier transparency on third-party software/firmware components
• PLAN-03: bidders should provide "a listing of the open-source components in the system"
• MANAGE-01: contractual vulnerability disclosure and patch evidence
• MANAGE-02 / GENERAL-04: inventories and vulnerability remediation

The post also covers the MDR/IVDR exemption from the CRA (and how procurement closes that gap), the FDA Section 524B parallel, and practical takeaways for both suppliers and hospital buyers, ending with the sbomify workflow pitch.

Details

• Frontmatter follows existing Cowboy Neil post conventions (inline author block, tldr, faq for FAQ schema)
• Internal links verified against existing pages and post slugs
• No em-dashes per style guidance

Test plan

• bun run lint:markdown (dprint) passes
• Production Hugo build (extended 0.145.0) succeeds; post renders with author attribution and FAQ schema

🤖 Generated with Claude Code