feat(agent): cache control embedding index + auto-wire semantic pass (gated)

Item 2 of the semantic-mapping follow-ups.

Caching (2a): ControlIndex::load_or_build persists the embedded corpus to
snapshot_dir keyed by a corpus hash (control ids + requirement text). A later
scan reuses the embeddings unless the catalog changed, turning the per-scan
re-embed of the ~13.6k master-control corpus into a one-time cost. Atomic
write (temp + rename); self-invalidates on catalog change. ControlCheckSpec
gains Serialize/Deserialize to persist.

Auto-wire (2b): orchestrator Stage 5c runs semantic_stamp_findings after control
triage, gated on breakpilot.semantic_mapping (env BREAKPILOT_SEMANTIC_MAPPING,
default off). Stays off until verified live against a deployed master-controls
catalog; safe no-op meanwhile (the endpoint 400s pre-deploy and the pass warns +
returns 0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-core/src/config.rs

@@ -75,6 +75,11 @@ pub struct BreakpilotConfig {
     pub token: Option<SecretString>,
     /// Directory for catalog snapshots.
     pub snapshot_dir: String,
+    /// Enable the master-controls **semantic** mapping pass (embed regions,
+    /// retrieve nearest controls, grounded-judge). Off by default: it is the
+    /// scale path and stays gated until verified live against a deployed
+    /// master-controls catalog.
+    pub semantic_mapping: bool,
 }
 
 impl Default for BreakpilotConfig {
@@ -83,6 +88,7 @@ impl Default for BreakpilotConfig {
             base_url: None,
             token: None,
             snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+            semantic_mapping: false,
         }
     }
 }

compliance-core/src/control_check.rs

@@ -14,13 +14,14 @@
 //! The LLM supplies cross-language / cross-stack pattern recognition; this module
 //! supplies the determinism.
 
+use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 use crate::models::finding::{Finding, Severity};
 use crate::models::scan::ScanType;
 
 /// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ControlCheckSpec {
     /// Stable control id, e.g. `"cra-ai-8"`.
     pub control_id: String,