Why AI Governance Breaks Without AI-BOM