feat(controls): promote grounded controls to covered + enable LLM passes by default

The grounded surface path (Stage 5d) is validated live: against an absence-vuln
fixture it flags cra-ai-11 (unprotected login), cra-ai-24 (unlogged admin action),
and cra-ai-28/29/30 (unverified firmware update), each grounded + control-tagged.

- LUT: promote the 8 absence-based controls (cra-ai-6,11,12,24,27,28,29,30)
  needs_tooling -> covered (grounded-control-check binding). CRA coverage is now
  21 covered / 0 needs_tooling / 19 not_code_checkable.
- Enable both advanced LLM passes by default: semantic_mapping (validated in C5)
  and grounded_control_checks (validated here). Both were gated only for cost /
  verification; the GPU is in-house so cost isn't a constraint. Still no-ops
  unless breakpilot base_url is set and the catalog is reachable.
- Gated regression tests (ignored, not run by CI --lib): c5_example2.rs (semantic,
  4 varied vulns) and grounded_surface_live.rs (Stage 5d validation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/src/pipeline/orchestrator.rs

@@ -232,9 +232,9 @@ impl PipelineOrchestrator {
 
         // Stage 5c: semantic control mapping — scale path for the master-controls
         // corpus (no CWE to LUT on): embed each finding's region, retrieve the
-        // nearest master controls, grounded-judge, and stamp confirmed refs. Gated
-        // (default off) as the corpus embedding + per-finding judging is the heavy
-        // path; enabled once verified live against a deployed master-controls catalog.
+        // nearest master controls, grounded-judge, and stamp confirmed refs. On by
+        // default (validated live); the corpus embedding is cached so only the
+        // first scan after a catalog change pays it.
         if self.config.breakpilot.semantic_mapping {
             self.update_phase(scan_run_id, "semantic_control_mapping")
                 .await;
@@ -256,8 +256,8 @@ impl PipelineOrchestrator {
         // rate limiting, no security logging, no update-signature check) have no
         // syntactic pattern to match, so we retrieve the code surface each governs
         // and let the grounded judge decide whether it holds, producing net-new
-        // findings already tagged + grounded. Gated (default off): absence
-        // detection is the least deterministic path, kept off until tuned live.
+        // findings already tagged + grounded. On by default (validated live); it
+        // covers the 8 absence-based CRA controls.
         if self.config.breakpilot.grounded_control_checks {
             self.update_phase(scan_run_id, "grounded_control_checks")
                 .await;