feat(ai-sdk): classify NIST/OWASP/Grundschutz as technical_standard (#37)

ai-compliance-sdk/internal/ucca/legal_rag_intent_test.go

@@ -132,3 +132,17 @@ func TestRerank_OffTopicStandard_BlockedByGuard(t *testing.T) {
 		t.Errorf("off-topic standard must not win even with control intent, got %s", out[0].SourceClass)
 	}
 }
+
+func TestRerank_ControlQuestion_UntaggedNISTLifted(t *testing.T) {
+	// The existing NIST corpus is UNtagged (no source_class). It must still be classified
+	// technical_standard via markers and lifted on a control question — the whole reason
+	// the lift path classifies instead of trusting the raw payload field.
+	results := []LegalSearchResult{
+		{RegulationShort: "NIST SP 800-82r3", ArticleLabel: "AU-8", Score: 0.62},
+		{RegulationShort: "CRA", ArticleLabel: "Art. 13 CRA", Category: "regulation", Score: 0.58},
+	}
+	out := rerankByAuthority("Welche Controls passen zu Security Updates?", results)
+	if out[0].RegulationShort != "NIST SP 800-82r3" {
+		t.Errorf("untagged NIST should be lifted Top-1 on a control question, got %q", out[0].RegulationShort)
+	}
+}