feat(control-pipeline): Control Ontology v1 — action types, evidence/container/framework detection

Block 7.1-7.2 from masterplan:
- 26 action_types with German aliases + phase mapping
- Negative obligation patterns (exclude, prevent, enforce)
- Container detection (11 composite objects that must not become atomic)
- Evidence detection (14 indicators + "X dokumentieren" pattern)
- Framework reference detection (OWASP, NIST, BSI, CSA, ISO patterns)
- classify_obligation() routes to: atomic, composite, evidence, framework_container
- build_canonical_key() for deterministic dedup
- 36 tests covering all classification functions

Also: merge_key bug fix in _process_pass0b_control()

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

control-pipeline/services/decomposition_pass.py

@@ -3395,7 +3395,8 @@ class DecompositionPass:
                     "decomposition_method": "pass0b",
                     "engine_version": "v2",
                     "action_object_class": getattr(atomic, "domain", ""),
-                    "merge_group_hint": atomic.source_regulation or "",
+                    "merge_group_hint": getattr(atomic, "merge_group_hint", "") or atomic.source_regulation or "",
+                    "obligation_candidate_id": atomic.obligation_candidate_id or "",
                     "decomposition_confidence": getattr(
                         atomic, "_decomposition_confidence", None
                     ),