feat(controls): promote grounded controls to covered + enable LLM passes by default

The grounded surface path (Stage 5d) is validated live: against an absence-vuln
fixture it flags cra-ai-11 (unprotected login), cra-ai-24 (unlogged admin action),
and cra-ai-28/29/30 (unverified firmware update), each grounded + control-tagged.

- LUT: promote the 8 absence-based controls (cra-ai-6,11,12,24,27,28,29,30)
  needs_tooling -> covered (grounded-control-check binding). CRA coverage is now
  21 covered / 0 needs_tooling / 19 not_code_checkable.
- Enable both advanced LLM passes by default: semantic_mapping (validated in C5)
  and grounded_control_checks (validated here). Both were gated only for cost /
  verification; the GPU is in-house so cost isn't a constraint. Still no-ops
  unless breakpilot base_url is set and the catalog is reachable.
- Gated regression tests (ignored, not run by CI --lib): c5_example2.rs (semantic,
  4 varied vulns) and grounded_surface_live.rs (Stage 5d validation).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

control-map/src/lib.rs

@@ -178,11 +178,13 @@ mod tests {
     }
 
     #[test]
-    fn every_bucket_is_represented() {
+    fn covered_and_not_checkable_are_populated() {
         let s = ControlMap::cra().unwrap().summary();
         assert!(s.covered > 0);
-        assert!(s.needs_tooling > 0);
         assert!(s.not_code_checkable > 0);
+        // needs_tooling is now empty: every code-checkable control is either
+        // tool-covered or covered by the grounded surface pass.
+        assert_eq!(s.needs_tooling, 0);
     }
 
     #[test]
@@ -215,14 +217,16 @@ mod tests {
     }
 
     #[test]
-    fn coverage_reflects_the_b_track_split() {
+    fn coverage_after_grounded_promotion() {
         let s = ControlMap::cra().unwrap().summary();
-        // 9 already tool-covered + B1's 4 custom-semgrep controls.
-        assert_eq!(s.covered, 13);
-        // The 8 grounded surface controls stay needs_tooling until live-tuned.
-        assert_eq!(s.needs_tooling, 8);
-        // B3 marked the 4 pure-architectural controls not code-checkable.
+        // 9 off-the-shelf + 4 custom-semgrep + 8 grounded surface controls (promoted
+        // after the grounded path was validated live).
+        assert_eq!(s.covered, 21);
+        // Nothing left as needs_tooling — every code-checkable control is covered.
+        assert_eq!(s.needs_tooling, 0);
+        // The 4 pure-architectural controls remain not code-checkable.
         assert_eq!(s.not_code_checkable, 19);
+        assert_eq!(s.total(), 40);
     }
 
     #[test]