feat(bridge): security-updates obligation cut (CRA Annex I (2)(c)/Art 13) — 9 obligations

- obligations/cra_updates.json: 9 (6 LEGAL_MINIMUM + 3 BEST_PRACTICE), Beziehungen.
  Pipeline 670->318 micro->15 review-units -> Opus-Synthese. Synthese gut kalibriert ->
  light review (KEINE Hart-Re-Tier, vs Auth/Remote-Access). out_of_scope M4/M7.
  5 capability_candidate-Marker (signed/trusted/automatic/rollback/testing) fuer
  Phase-4-Capability-Pruefung. Anker approximativ (curation.anchor_quality).
- obligation_join_keys.json: 84 -> 93 (updates 9). Alle 6 CRA-P1-Domaenen abgedeckt.
- precluster.py: updates-Scope.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/obligation_discovery/precluster.py

@@ -26,6 +26,13 @@ SCOPES = {
                       "%remote access%", "%remote maintenance%", "%remote management%",
                       "%remote-wartung%", "%remote-zugriff%", "%remote-zugang%",
                       "%sichere fernwartung%", "%fernsteuerung%"],
+    "updates": ["%sicherheitsupdate%", "%security update%", "%sicherheits-update%",
+                "%security patch%", "%sicherheitspatch%", "%patch-management%",
+                "%patchmanagement%", "%patch management%", "%firmware-update%",
+                "%firmware update%", "%software-update%", "%software update%",
+                "%automatische aktualisierung%", "%update-mechanismus%",
+                "%update-bereitstellung%", "%bereitstellung von updates%",
+                "%sichere aktualisierung%", "%signierte update%", "%update-paket%"],
 }