feat(controls): enrich semantic retrieval query with finding intent + C5 live test (#222)

compliance-agent/src/controls/scan_triage.rs

@@ -234,13 +234,22 @@ pub async fn semantic_stamp_findings(
         let Some(region) = fetch_region(repo_path, &file, line) else {
             continue;
         };
-        let region_emb = match llm.embed(vec![region.content.clone()]).await {
+        // Retrieve on the finding's intent + the code, not the region alone: two
+        // findings in one file share overlapping windows and otherwise embed alike,
+        // collapsing onto the same controls. The finding's title/description carry
+        // the discriminating signal (e.g. "brute-force protection" vs "weak hash").
+        // The raw `region` still goes to the judge for snippet grounding.
+        let query = format!(
+            "{}\n{}\n\n{}",
+            finding.title, finding.description, region.content
+        );
+        let query_emb = match llm.embed(vec![query]).await {
             Ok(mut embs) => match embs.pop() {
                 Some(v) => v,
                 None => continue,
             },
             Err(e) => {
-                tracing::warn!(error = %e, "region embed failed; skipping finding");
+                tracing::warn!(error = %e, "query embed failed; skipping finding");
                 continue;
             }
         };
@@ -248,7 +257,7 @@ pub async fn semantic_stamp_findings(
             .check(
                 &index,
                 &region,
-                &region_emb,
+                &query_emb,
                 SEMANTIC_TOP_K,
                 &finding.repo_id,
             )