feat(pipeline): PLC/SPS control-logic security scanner (IEC 61131-3)

Implements ScanType::PlcControlLogic — the missing piece for PlcSps targets,
which previously classified but ran no scan.

New `pipeline::plc`:
- A real IEC 61131-3 Structured Text front end: lexer + recursive-descent parser
  → AST (POUs, typed VAR sections, statements, expressions). Tolerant recovery so
  odd constructs never sink a file.
- PLCopen XML extractor: pulls each ST POU's interface vars + `<ST>` body and
  reconstructs equivalent ST, so raw `.st` files and PLCopen projects share one
  analysis path.
- Eight semantic, guard-aware rules over the AST → findings: hardcoded
  credentials, default/weak passwords, safety-interlock/watchdog bypass, array
  indexed by unvalidated input, division without a zero-guard (suppressed when an
  enclosing `IF <d> <> 0` proves it), insecure comm (auth/encryption disabled),
  and cleartext OT protocol ports, plus unstructured JMP. Each carries CWE +
  remediation.
- `PlcControlLogicScanner` (Scanner impl) walks the project tree and emits
  `Finding`s (dedup fingerprint, file, line, severity).

Wired into `run_target_pipeline`: when the scan plan includes PlcControlLogic,
`run_plc_scan` ingests the PlcProject artifact, analyzes it, and persists the
findings (findings_count handled by run_target).

Demo fixtures under examples/plc-demo/ (a vulnerable pump-station `.st` + a
PLCopen `conveyor.xml`). Tests: parser, all-rules-fire, guarded-clean-is-quiet,
and an end-to-end tree scan — 5 passing.

Adds `roxmltree` (read-only XML) for PLCopen parsing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compliance-agent/Cargo.toml

@@ -42,6 +42,8 @@ tokio-cron-scheduler = "0.13"
 dotenvy = "0.15"
 hmac = "0.12"
 walkdir = "2"
+# Read-only XML tree parsing for PLCopen project files (POU extraction).
+roxmltree = "0.20"
 base64 = "0.22"
 urlencoding = "2"
 futures-util = "0.3"