feat(citability): logischer norm_id-Join auf legal_basis (KB-v2 Zitier-Vertrag)

Wake-up #2 (Domaene 2): Zitierfaehigkeit ohne char-Level-Spans via logischem
norm_id-Join auf KB-v2-Units (bp_compliance_kb_2026_1_build). Konvention (Board
Compliance/KB-v2 2026-07-01): EU-<ACT>-Anhang<ROM> (Annex-Ebene, confirmed) /
EU-<ACT>-Art<N> + EU-<ACT>-Kapitel<ROM> (verify_pending). Namensvariante
EU-MaschVO-* (NICHT MaschinenVO). KEINE neue Klasse — norm_ids ist ein Attribut
auf legal_basis (freeze-safe).

- 65/65 legal_basis gejoint (CRA 40 + MaschVO 25), 0 unparsed; 64 Obligations
  citation_status -> norm_id_linked (BP/guidance-anchored bleiben ohne norm_id).
- 53 annex_confirmed, 12 verify_pending; distinkt 5 Annex-IDs + 19 Art/Kapitel.
- norm_id_manifest.json = KB-v2-Handoff (verify_pending Art-/Kapitel-IDs pruefen).
- Granularitaet annex-grob (Part/Punkt = KB-Enhancement TBD); Artikel-norm_ids in
  KB-v2 noch zu verifizieren.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

obligations/cra_authentication.json

@@ -26,7 +26,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(d)",
-     "citation": "protect... by ensuring protection from unauthorised access, including by reporting... appropriate control mechanisms incl. authentication, identity or access management"
+     "citation": "protect... by ensuring protection from unauthorised access, including by reporting... appropriate control mechanisms incl. authentication, identity or access management",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -1391,7 +1395,7 @@
    "member_count": 1339,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.95,
@@ -4682,7 +4686,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(e)",
-     "citation": "protect the confidentiality... through state-of-the-art mechanisms incl. encryption"
+     "citation": "protect the confidentiality... through state-of-the-art mechanisms incl. encryption",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -5277,7 +5285,7 @@
    "member_count": 533,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.85,
@@ -5650,7 +5658,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(e)",
-     "citation": "protect the confidentiality of stored, transmitted or otherwise processed data"
+     "citation": "protect the confidentiality of stored, transmitted or otherwise processed data",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -5994,7 +6006,7 @@
    "member_count": 315,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.85,
@@ -6326,7 +6338,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(a)",
-     "citation": "be made available with a secure by default configuration"
+     "citation": "be made available with a secure by default configuration",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [],
@@ -6347,7 +6363,7 @@
    "member_count": 9,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.8,
@@ -8408,7 +8424,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(e)",
-     "citation": "protect the confidentiality of... transmitted... data... incl. encryption in transit"
+     "citation": "protect the confidentiality of... transmitted... data... incl. encryption in transit",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -8485,7 +8505,7 @@
    "member_count": 57,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.8,
@@ -10214,7 +10234,11 @@
      "source": "CRA",
      "regulation_code": "eu_2024_2847",
      "anchor": "Annex I (2)(c)",
-     "citation": "ensure that vulnerabilities can be addressed through security updates... ensuring integrity"
+     "citation": "ensure that vulnerabilities can be addressed through security updates... ensuring integrity",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -10273,7 +10297,7 @@
    "member_count": 37,
    "relationships": [],
    "citation_anchor_ids": [],
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "draft",
    "provenance": {
     "discovery_confidence": 0.78,
@@ -10458,5 +10482,12 @@
   ],
   "from_obligations": 54,
   "to_obligations": 29
+ },
+ "norm_id_contract": {
+  "convention": "EU-<ACT>-Anhang<ROM> (Annex-Ebene) / EU-<ACT>-Art<N> (verify) — KB-v2 bp_compliance_kb_2026_1_build",
+  "act_naming": "EU-MaschVO-* (NICHT MaschinenVO)",
+  "granularity": "annex-grob — 'Annex I Part II (1)' -> EU-CRA-AnhangI; Part/Punkt = KB-Enhancement TBD",
+  "article_status": "EU-<ACT>-Art<N> in KB-v2 noch zu verifizieren; Annex-IDs confirmed",
+  "source": "Board Compliance/KB-v2 2026-07-01"
  }
 }