The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.

The CRA's 24-hour reporting clock asks which products ship an exploited component. Your SBOM lists what is inside one artifact. Those are different questions, and the gap between them is a cross-repo IaC dependency graph.