Currently, whenever the driver's Cargo.toml / Cargo.lock file changes, an updated SBOM is generated and sent as a PR.  This is convenient because it means the SBOM always stays in sync and all a human has to do is approve and merge.

However, the current implementation has some rough edges:

• it generates a lot of PRs, which make it harder to read over the change history
• it incurs a full evergreen run, which is wasted time and compute since updating the SBOM itself will have precisely zero effect on test results
• it's leaking branches

These all seem addressable with a little engineering effort:

• AFAIK the SBOM is only needed for release artifacts; maybe it could be set up to only run on release branches?
• The test runners can short-circuit if the only change is the SBOM; even better would be to predicate the evergreen run itself, but I don't know if that's possible.
• Branches can be cleaned up by a follow-up workflow.