fix(agents): Impressum+Cookie delegieren MC-Laden ans Main Tool — Scope-Filter + Maßnahmen

Regression: Der v3-Agent-Pfad baute eine parallele MC-Pipeline
(_load_impressum_mcs / _load_cookie_mcs, Roh-SELECT) und lief damit an
allen Schutzmechanismen der Engine vorbei → GOV/Branchen-MCs als HIGH bei
OEM/Zulieferer, fremde MCs (Bestellbestätigung), und action=check_question
(Fragen statt Maßnahmen im Frontend).

- Agent delegiert MC-Laden an rag_document_checker._load_controls
  (P72-Scope, check_type='text', fits_doc_type/scope_requires).
- Subtraktives Sektor-Gate (SECTOR_PREFIXES) + Themen-Gate am Agent-Rand.
- action = konkrete Maßnahme (Imperativ) statt check_question.
- rag_document_checker: from __future__ import annotations (3.9-Import).
- mcs: Name-Pattern erkennt "Aktiengesellschaft" (OEM-Impressums).
- Tote GT-/Semantic-/Routes-Tests wiederbelebt (v3-Mismatch +
  agent.cascade-Patch-Target). Alle 72 Specialist-Tests grün.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend-compliance/tests/test_semantic_validator.py

@@ -13,6 +13,7 @@ from compliance.services.specialist_agents._semantic_validator import (
     standard_label,
     validate_present,
 )
+from tests.fixtures.impressum_groundtruth import make_mc
 
 
 def _run(coro):
@@ -91,10 +92,33 @@ def test_semantic_demotion_high_to_low(monkeypatch):
         "compliance.services.specialist_agents._semantic_validator.cascade",
         _fake_cascade,
     )
+
+    # Agent delegiert MC-Laden ans Main Tool → _load_controls mocken.
+    # control_id == field_id 'kontakt_telefon', damit der Semantic-Demote
+    # das Finding ueber die LLM-Antwort zuordnet.
+    async def _fake_load(doc_type, db_url, limit, business_scope=None):
+        return [make_mc("kontakt_telefon",
+                        ["Telefon Telefonnummer Rufnummer"],
+                        severity="HIGH")]
     monkeypatch.setattr(
-        "compliance.services.specialist_agents.impressum.agent.cascade",
-        _fake_cascade,
+        "compliance.services.rag_document_checker._load_controls",
+        _fake_load,
     )
+
+    async def _no_match(*a, **kw):
+        return set()
+    monkeypatch.setattr(
+        "compliance.services.mc_embedding_matcher.embedding_match",
+        _no_match, raising=False,
+    )
+
+    async def _no_embed(*a, **kw):
+        return None
+    monkeypatch.setattr(
+        "compliance.services.mc_embedding_matcher.ensure_mc_embeddings",
+        _no_embed, raising=False,
+    )
+
     # Text OHNE Telefon-Label → MC matched nicht → HIGH-Finding
     text = (
         "Beispiel GmbH\nMusterstr. 1\n12345 Berlin\n"