fix(iace): assign mitigations to ALL hazards per category

hazardIDsByCategory changed from map[string]uuid.UUID to
map[string][]uuid.UUID — measures are now distributed to every
hazard in a category, not just the last one created.

Previously 94/108 hazards had no measures, now all get them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/iace_handler_init_helpers.go

@@ -369,18 +369,15 @@ func normalizeZoneKey(zone string) string {
 	return strings.Join(sig, "_")
 }
 
-// findHazardForMeasureByCategory finds a matching hazard for a measure.
-func findHazardForMeasureByCategory(measureCat string, hazardsByCategory map[string]uuid.UUID) uuid.UUID {
-	if id, ok := hazardsByCategory[measureCat]; ok {
-		return id
+// findHazardsForMeasureByCategory finds all hazards matching a measure's category.
+func findHazardsForMeasureByCategory(measureCat string, hazardsByCategory map[string][]uuid.UUID) []uuid.UUID {
+	if ids, ok := hazardsByCategory[measureCat]; ok {
+		return ids
 	}
-	for cat, id := range hazardsByCategory {
+	for cat, ids := range hazardsByCategory {
 		if len(measureCat) > 3 && len(cat) > 3 && cat[:4] == measureCat[:4] {
-			return id
+			return ids
 		}
 	}
-	for _, id := range hazardsByCategory {
-		return id
-	}
-	return uuid.Nil
+	return nil
 }