feat(agent): wire control triage into the scan pipeline (end-to-end SAST)

After the deterministic tools run, the orchestrator's new control_triage stage
stamps each finding with the compliance control(s) it is evidence for and flags
control false positives. triage_repo_findings builds control specs from the
ingested OSCAL catalog, reads a code window per finding, and runs ControlTriage
(control-map LUT -> grounded judge). Adds Finding.control_refs (serde default);
the ground gate stamps it. Opt-in via BREAKPILOT_BASE_URL. 2 region tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/src/controls/checker.rs

@@ -92,7 +92,7 @@ mod tests {
         ];
         let findings = checker.check(&spec(), &regions, "repo").await;
         assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].rule_id.as_deref(), Some("cra-ai-8"));
+        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
         assert_eq!(findings[0].line_number, Some(2));
     }