feat(controls): B2 — grounded surface checks for absence-based CRA controls

Second slice of B (hybrid coverage): the controls violated by an *absence*
(no rate limiting, no security logging, no update-signature check) have no
syntactic pattern for semgrep, so we retrieve the code surface each governs and
let the grounded judge decide whether the control holds.

- controls/surface.rs: deterministic, bounded surface retrieval (keyword +
  window, capped per control) for cra-ai-6,11,24,27,28,29,30.
- grounded_surface_findings(): retrieve surfaces -> GroundedControlChecker ->
  net-new findings, each already tagged with its control and grounded to a real
  snippet (ground() drops anything not quoting verbatim code).
- orchestrator Stage 5d, gated on breakpilot.grounded_control_checks
  (BREAKPILOT_GROUNDED_CHECKS, default off) — absence detection is the least
  deterministic path, kept off until tuned against live scans.
- LUT: the 7 controls' notes now point to the gated grounded mechanism (kept
  needs_tooling; coverage stays honest until live-validated).

Local validation (real Qwen, temp 0), correct positive+negative discrimination:
  cra-ai-11 unprotected login  -> violates, CWE-307, grounded; protected -> false
  cra-ai-24 unlogged admin del -> violates, CWE-778, grounded; logged   -> false

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

control-map/data/cra_control_map.json

@@ -53,7 +53,7 @@
       "control": "cra-ai-6",
       "title": "Integritaetspruefung",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
@@ -139,7 +139,7 @@
       "control": "cra-ai-11",
       "title": "Brute-Force-Schutz",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
@@ -308,7 +308,7 @@
       "control": "cra-ai-24",
       "title": "Security-Logging",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
@@ -329,28 +329,28 @@
       "control": "cra-ai-27",
       "title": "Log-Integritaet und -Aufbewahrung",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
       "control": "cra-ai-28",
       "title": "Sichere Update-Mechanismen",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
       "control": "cra-ai-29",
       "title": "Update-Authentizitaet",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {
       "control": "cra-ai-30",
       "title": "Update-Integritaet",
       "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
       "status": "needs_tooling"
     },
     {