feat(s132): the control mapping, held to the tree and to NIST's catalogue

[HackTuah]

Slice 132, the control mapping. Stacked on #117 (slice 130): this PR's base is 130's branch, so the diff shows 132 alone. Merge #117 first.

What lands

docs/regulated/control-mapping.md maps Trinity's mechanisms to NIST SP 800-53 Rev 5 and SP 800-218. It opens by saying what it is not: an assessment, an ATO, an SSP, or a claim that any baseline is met.

Table	Rows	Identifiers	Trinity's	shared	the deployment's
SP 800-53	65	45	25	25	15
SSDF	13	13 tasks	13	0	0

Every family and practice with no row is listed with its reason.

test/control_mapping_test.exs (34 tests) holds the document to the tree:

• every named path, test, Mix task and function must exist;
• every identifier must be active in NIST's OSCAL catalogues, pinned by commit 78650f02 and SHA-256 in usnistgov/oscal-content (CC0);
• ownership must match the responsibility matrix and the standards register;
• the disclaimers and the forbidden words are checked;
• every regulated refusal, census test and gate step must be cited or listed.

Each rule has a planted violation that fails, and those plants stay as permanent tests.

Matrix corrections (please review)

• A stale row, corrected. The matrix said the model allow-list was NOT IN TREE; the regulated profile has enforced it since regulated-boot.
• Nine rows added. Two state gaps the pack had not written down:
  • connections to Trinity are plain HTTP;
  • the web pages carry no authentication, among them /permissions, where approvals are answered, while the hardened image binds every interface (TRINITY_BIND=0.0.0.0). Mapped as IA-2, the deployment's, for now. An owner decision is pending: refuse a non-loopback bind under :regulated, or authenticate the pages.

Evidence

• Author's gate: exit 0 twice, 1078 passed (20 properties, 1058 tests), 18 excluded, prod_check: PASS.
• Reviewer re-run before commit: test/control_mapping_test.exs, 34 passed; mix format --check-formatted OK.