Watch this SBOM: subscribe the document's resolved lines to EOL and KEV alerts

Body: { "email": "...", "sbom": <CycloneDX or SPDX JSON>, "strict": false }. Every component is resolved the same way /v1/sbom resolves it (purl exact, name only without a purl, never a guess) and each resolved product line (slug:cycle) joins the subscriber's watch list on the existing alert system: a confirmation email first (double opt-in), then emails when a watched line comes inside 12 months of end of life, at 90/60/30/7 days, on the day it passes, and immediately when a CISA known-exploited CVE lands on a watched end-of-life line. Only the slug:cycle lines are stored - never the document. The list replaces the subscriber's previous watch list; 50 lines maximum.