feat: Capability Convergence Explanation — why the registry converges + Core/Domain (Phase Ω)

The mature step after Medical is not the next domain but understanding WHY the registry converges.
Three derived views over existing data (no ML, no new architecture):
  1. Why converge? — a domain matrix per cross-domain MCAP + a curated REASON (the moat: not "MCAP-X
     exists" but "why MCAP-X must exist": software product / supply chain / product operation /
     universal process).
  2. Capability Families — ~75 MCAPs collapse to ~15 curated families (knowledge/capability_families/
     families.yaml), each with the reason it is universal or domain-specific.
  3. Core vs Domain — a COMPUTED property (not a new class): Core recurs across >=2 independent domains
     AND source types; Domain stays in one. Medical made it obvious (new medical caps are nearly all
     Domain; update/SBOM/access/logging are Core).

Non-runtime -> no deploy. 4 tests pass, check-loc 0.

backend-compliance/tests/test_capability_convergence_explanation.py

@@ -0,0 +1,48 @@
+"""Capability Convergence Explanation — why the registry converges (Phase Ω, understand the core).
+
+Pins the three derived views: the why-converge domain matrix (cross-domain core caps + a reason), the
+family reduction (~60-70 MCAPs collapse to a small set of families), and the COMPUTED Core-vs-Domain
+split (Core recurs across independent domains+types; Domain stays in one — which Medical made obvious).
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+
+
+def _run():
+    root = os.path.join(os.path.dirname(__file__), "..")
+    r = subprocess.run(
+        [sys.executable, "reference_scenarios/capability_convergence_explanation.py"],
+        cwd=root, env={**os.environ, "PYTHONPATH": "."}, capture_output=True, text=True,
+    )
+    assert r.returncode == 0, r.stderr
+    return r.stdout
+
+
+def test_runs_and_explains_why():
+    out = _run()
+    assert "WARUM konvergieren" in out
+    assert "Universeller Prozess" in out  # a reason, not just a count
+
+
+def test_cross_domain_core_caps_in_matrix():
+    out = _run()
+    for cap in ["secure_signed_update_distribution", "sbom_creation", "technical_vulnerability_management"]:
+        assert cap in out
+
+
+def test_families_reduce_the_registry():
+    out = _run()
+    assert "Capability Families" in out
+    assert "reduzieren sich auf" in out
+    for fam in ["Risk", "Update", "Identity & Access", "Inventory & Composition"]:
+        assert fam in out
+
+
+def test_core_vs_domain_is_computed():
+    out = _run()
+    assert "BERECHNETE Eigenschaft" in out
+    assert "**Core (" in out and "**Domain (" in out