Milestone 10: release readiness and repository assurance

[anthfuller]

Summary

• add machine-readable traceability for all 51 controls and validate it in CI
• harden canonical JSON input and output-path handling
• add immutable CFF schema validation and expand supply-chain checks
• reconcile control-count, ownership, release-readiness, and SBOM documentation
• prepare version 4.0.0 release documentation without publishing

Validation

• 119 tests passed
• clean-user acceptance passed
• contract, policy, prompt, settings, allowlist, traceability, CFF, links, fences, YAML, whitespace, OPA, evidence/replay, golden-scenario, and dependency-audit checks passed

Boundaries

This PR does not create a tag or release, publish artifacts, update Zenodo, or merge itself.