feat(iace): generic cross-domain leak gates + norm vocab reconciliation

- Domain-gate ~15 foreign machine classes (pool, amusement, paint booth,
  tank farm, reactor, lathe/chips, saw, film/carton, robot, mobile cab,
  asbestos, playground swing) in pattern_domain_gates.go so ungated hazard
  patterns stop leaking into unrelated machines; matching emit keywords
  added in keyword_dictionary.go (gate+emit share one vocabulary).
- Extend the cross-domain precision guard to 6 machine classes (press,
  cobot, motor, welding + the 2 GTs) with per-case homeDomains, so a
  machine's own domain terms are never flagged. GT coverage stays 100%.
- Reconcile the fine-grained norm machine-type vocabulary (455 keys) with
  the 68 canonical dropdown keys via canonicalMachineType() family folding
  in matchNorm — welding 0->17, robotics_cobot 0->6, press 8->13,
  circular_saw 1->35 machine-specific C-norms. Pattern gating left strict.
- Fix initialize?force=true summary index-shift that mislabeled counts
  (reported matched-patterns as "hazards"); now uses named step vars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ai-compliance-sdk/internal/iace/norms_engine.go

@@ -88,11 +88,15 @@ func matchNorm(norm NormReference, machineType string, hazardSet, tagSet map[str
 	var reasons []string
 	var sources []string
 
-	// Machine type match
+	// Machine type match — compared on the CANONICAL family so the fine-grained
+	// norm vocabulary (welding_machine, band_saw, mobile_crane ...) reconciles
+	// with the 68 canonical dropdown keys (welding, circular_saw, crane ...).
+	// Without this fold, exact "==" left most C-norms unreachable by machine type.
 	machineTypeMatched := false
 	if machineType != "" && len(norm.MachineTypes) > 0 {
+		projCanon := canonicalMachineType(machineType)
 		for _, mt := range norm.MachineTypes {
-			if mt == machineType {
+			if canonicalMachineType(mt) == projCanon {
 				bestConfidence = 0.9
 				reasons = append(reasons, "Maschinentyp: "+machineType)
 				sources = append(sources, "machine_type:"+machineType)