Fix SBOM SPDX references

- Ensure SBOM relationships point at SPDX IDs emitted in the document
- Preserve API patch metadata so patch relationships survive API loads
- Cover patch packages and API-loaded patch regression cases