feat: Automotive convergence stress test — same capability from many sources (Phase Ω #2)

Not another domain to prove agnosticism (Environmental did that) but a DIFFERENT property: can the
SAME capability be fed by many overlapping Requirement Sources at once without the model becoming
unstable? Realistic setup — a supplier with ISO 9001 + IATF 16949 + TISAX + ASPICE + CSMS + SUMS
developing an ECU for OEM X. Seven sources (CRA, UNECE R155/CSMS, R156/SUMS, IATF, TISAX, ASPICE,
OEM X) with deliberate overlap, run through the SAME engine (0 runtime code, data only).

Three new measurements (user-requested):
  - Capability Convergence: technical_vulnerability_management = 4 sources across 3 source TYPES
    (regulation + certification + contract); secure_signed_update_distribution = 4 sources. The
    overlap is where the economic value lives ("one capability replaces five evidence worlds").
  - Existing-vs-New: 13/27 required caps reuse existing cyber/environmental MCAPs (48%) -> the
    registry is starting to converge; the automotive-specific rest (CSMS/SUMS/ASPICE/functional
    safety) is expectedly new (a maturity hint, not an architecture break).
  - Business Leverage: a convergent capability satisfies N regulations AND unlocks the OEM market —
    more convincing to a GF than "satisfies five laws". (Regulatory Leverage counts regulations;
    Business Leverage counts regulations + markets/customers.)

Ledger gains the automotive row (0/0, 14 new types, data_only); stability stays 7/7 = 100%. The
verdict recommends the user's next step: NOT a new domain but PAUSE and analyse the registry for the
cross-domain high-convergence core MCAPs. Non-runtime -> no deploy. 12 tests pass, check-loc 0.

backend-compliance/tests/test_automotive_convergence_stress_test.py

@@ -0,0 +1,62 @@
+"""Automotive convergence stress test — the SAME capability from many sources (Phase Ω #2).
+
+Pins the convergence property: a realistic multi-certified supplier (ISO 9001 + IATF 16949 + TISAX +
+ASPICE + CSMS + SUMS) developing an ECU for OEM X feeds the SAME capability from many overlapping
+Requirement Sources, and the model stays stable (0 runtime). Checks the three new measurements:
+Capability Convergence (sources x distinct types), Existing-vs-New reuse, and Business Leverage.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+
+
+def _run():
+    root = os.path.join(os.path.dirname(__file__), "..")
+    r = subprocess.run(
+        [sys.executable, "reference_scenarios/automotive_convergence_stress_test.py"],
+        cwd=root, env={**os.environ, "PYTHONPATH": "."}, capture_output=True, text=True,
+    )
+    assert r.returncode == 0, r.stderr
+    return r.stdout
+
+
+def test_runs_end_to_end_multi_source():
+    out = _run()
+    assert "Automotive Convergence Stress Test" in out
+    assert "27 distinct geforderte Capabilities" in out
+    assert "0 neue Runtime-Klassen" in out
+
+
+def test_capability_convergence_ranks_the_most_shared_cap_first():
+    out = _run()
+    # the most convergent capability is fed by 4 sources across 3 distinct source types
+    assert "| `technical_vulnerability_management` | 4 | 3 |" in out
+    assert "| `secure_signed_update_distribution` | 4 | 2 |" in out
+
+
+def test_existing_vs_new_reuse_signal():
+    out = _run()
+    # 13 of 27 required caps reuse existing cyber/environmental MCAPs (registry converging)
+    assert "Reuse aus Cyber/Umwelt): 13/27 = 48%" in out
+    assert "Registry zu konvergieren" in out
+
+
+def test_business_leverage_is_markets_plus_regulation():
+    out = _run()
+    assert "Business Leverage" in out
+    assert "öffnet den **OEM-Markt**" in out
+
+
+def test_recommends_registry_analysis_not_next_domain():
+    out = _run()
+    assert "innehalten und die Registry analysieren" in out
+    assert "Plattformkern" in out
+
+
+def test_no_real_company_names():
+    out = _run().lower()
+    for name in ["eto", "owis", "winterhalter", "bmw", "volkswagen", "bosch"]:
+        assert name not in out