feat(controls): promote grounded controls to covered + enable LLM passes by default

The grounded surface path (Stage 5d) is validated live: against an absence-vuln
fixture it flags cra-ai-11 (unprotected login), cra-ai-24 (unlogged admin action),
and cra-ai-28/29/30 (unverified firmware update), each grounded + control-tagged.

- LUT: promote the 8 absence-based controls (cra-ai-6,11,12,24,27,28,29,30)
  needs_tooling -> covered (grounded-control-check binding). CRA coverage is now
  21 covered / 0 needs_tooling / 19 not_code_checkable.
- Enable both advanced LLM passes by default: semantic_mapping (validated in C5)
  and grounded_control_checks (validated here). Both were gated only for cost /
  verification; the GPU is in-house so cost isn't a constraint. Still no-ops
  unless breakpilot base_url is set and the catalog is reachable.
- Gated regression tests (ignored, not run by CI --lib): c5_example2.rs (semantic,
  4 varied vulns) and grounded_surface_live.rs (Stage 5d validation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-core/src/config.rs

@@ -76,14 +76,15 @@ pub struct BreakpilotConfig {
     /// Directory for catalog snapshots.
     pub snapshot_dir: String,
     /// Enable the master-controls **semantic** mapping pass (embed regions,
-    /// retrieve nearest controls, grounded-judge). Off by default: it is the
-    /// scale path and stays gated until verified live against a deployed
-    /// master-controls catalog.
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// retrieve nearest controls, grounded-judge). On by default — validated live
+    /// against the deployed master-controls catalog. Still a no-op unless
+    /// `base_url` is set and the catalog is reachable.
     pub semantic_mapping: bool,
     /// Enable the **grounded surface** pass for absence-based controls (retrieve
-    /// the code surface a control governs, judge whether it holds). Off by
-    /// default: absence detection is the least deterministic path and stays gated
-    /// until tuned against live scans.
+    /// the code surface a control governs, judge whether it holds). On by default
+    /// — validated live; it covers the 8 absence-based CRA controls that no
+    /// syntactic rule can.
     pub grounded_control_checks: bool,
 }
 
@@ -93,8 +94,8 @@ impl Default for BreakpilotConfig {
             base_url: None,
             token: None,
             snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
-            semantic_mapping: false,
-            grounded_control_checks: false,
+            semantic_mapping: true,
+            grounded_control_checks: true,
         }
     }
 }