feat(ai-sdk): searchControls — deep dense pull recalls control sources on implementation questions

Measured (raw dense, top-500, "Welche Controls passen zu Security Updates?"):
NIST at dense rank 9 (115 chunks), CRA Annex at rank 8 — both shallow, just below
the client's small top-K, so the rank layer (#38) never saw them. OWASP: absent from
the corpus (separate ingest).

Add searchControls: on an explicit implementation question (queryWantsControls) pull a
deep dense pool (depth 60, no filter), classify each hit's role in code, and keep only
the four control-pool roles (operational/procedural requirement, control standard,
implementation guidance) — no source_role tagging of the corpus. Merge-dedup into the
pool; the existing rerank + applyControlRoles then order them (op_req > procedural >
standard > guidance). So CRA Annex I (operational_requirement) lands Top-1 and NIST
(control_standard) enters Top-3/5, while ENISA stays visible. Norm questions (no control
intent) are untouched.

Tested: isControlPoolRole, controlRoleOf payload classification (NIST/CRA-Annex/DORA).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ai-compliance-sdk/internal/ucca/control_role_test.go

@@ -48,3 +48,32 @@ func TestApplyControlRoles_PoolPreference(t *testing.T) {
 		}
 	}
 }
+
+func TestIsControlPoolRole(t *testing.T) {
+	for _, r := range []string{roleOperationalReq, roleProceduralReq, roleControlStandard, roleImplGuidance} {
+		if !isControlPoolRole(r) {
+			t.Errorf("%q should be in the control-pool", r)
+		}
+	}
+	for _, r := range []string{roleObligation, roleInterpretation, roleDefinition} {
+		if isControlPoolRole(r) {
+			t.Errorf("%q should NOT be in the control-pool", r)
+		}
+	}
+}
+
+func TestControlRoleOf_Payload(t *testing.T) {
+	// searchControls filters its deep dense pull by classifying the raw Qdrant payload.
+	nist := map[string]interface{}{"regulation_short": "NIST SP 800-82r3", "article": "AU-8"}
+	if got := controlRoleOf(nist); got != roleControlStandard {
+		t.Errorf("untagged NIST payload role = %q, want control_standard", got)
+	}
+	craAnnex := map[string]interface{}{"regulation_short": "CRA", "article": "Anhang-I", "category": "regulation"}
+	if got := controlRoleOf(craAnnex); got != roleOperationalReq {
+		t.Errorf("CRA Anhang payload role = %q, want operational_requirement", got)
+	}
+	dora := map[string]interface{}{"regulation_short": "DORA", "article_label": "Art. 5 DORA", "category": "regulation"}
+	if got := controlRoleOf(dora); isControlPoolRole(got) {
+		t.Errorf("DORA abstract article role = %q must be excluded from the control-pool", got)
+	}
+}