feat(citability): logischer norm_id-Join auf legal_basis (KB-v2 Zitier-Vertrag)

Wake-up #2 (Domaene 2): Zitierfaehigkeit ohne char-Level-Spans via logischem
norm_id-Join auf KB-v2-Units (bp_compliance_kb_2026_1_build). Konvention (Board
Compliance/KB-v2 2026-07-01): EU-<ACT>-Anhang<ROM> (Annex-Ebene, confirmed) /
EU-<ACT>-Art<N> + EU-<ACT>-Kapitel<ROM> (verify_pending). Namensvariante
EU-MaschVO-* (NICHT MaschinenVO). KEINE neue Klasse — norm_ids ist ein Attribut
auf legal_basis (freeze-safe).

- 65/65 legal_basis gejoint (CRA 40 + MaschVO 25), 0 unparsed; 64 Obligations
  citation_status -> norm_id_linked (BP/guidance-anchored bleiben ohne norm_id).
- 53 annex_confirmed, 12 verify_pending; distinkt 5 Annex-IDs + 19 Art/Kapitel.
- norm_id_manifest.json = KB-v2-Handoff (verify_pending Art-/Kapitel-IDs pruefen).
- Granularitaet annex-grob (Part/Punkt = KB-Enhancement TBD); Artikel-norm_ids in
  KB-v2 noch zu verifizieren.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

obligations/cra_core.json

@@ -23,7 +23,11 @@
     {
      "source": "CRA",
      "anchor": "Annex I Part I (2)(j)",
-     "citation": "limit attack surfaces, including external interfaces"
+     "citation": "limit attack surfaces, including external interfaces",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -38,7 +42,7 @@
     "component_remote_interface_security"
    ],
    "primary_implementation": "NIST CM-7",
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "core_from_5b"
   },
   {
@@ -56,7 +60,11 @@
     {
      "source": "CRA",
      "anchor": "Annex I Part I (2)(f)",
-     "citation": "protect the integrity of stored, transmitted or processed data, software and configuration"
+     "citation": "protect the integrity of stored, transmitted or processed data, software and configuration",
+     "norm_ids": [
+      "EU-CRA-AnhangI"
+     ],
+     "norm_id_status": "annex_confirmed"
     }
    ],
    "guidance_basis": [
@@ -74,9 +82,16 @@
     "code_signing"
    ],
    "primary_implementation": "NIST SI-7",
-   "citation_status": "pending_span_anchor",
+   "citation_status": "norm_id_linked",
    "review_status": "core_from_5b"
   }
  ],
- "relationships": []
+ "relationships": [],
+ "norm_id_contract": {
+  "convention": "EU-<ACT>-Anhang<ROM> (Annex-Ebene) / EU-<ACT>-Art<N> (verify) — KB-v2 bp_compliance_kb_2026_1_build",
+  "act_naming": "EU-MaschVO-* (NICHT MaschinenVO)",
+  "granularity": "annex-grob — 'Annex I Part II (1)' -> EU-CRA-AnhangI; Part/Punkt = KB-Enhancement TBD",
+  "article_status": "EU-<ACT>-Art<N> in KB-v2 noch zu verifizieren; Annex-IDs confirmed",
+  "source": "Board Compliance/KB-v2 2026-07-01"
+ }
 }