Add SOC2/ISO 27001 compliance control evidence report

[JE-Chen]

Governance capstone — turn the controls the framework already ships into an auditor-readable report. Full layers + tests + EN/Zh v37 docs + README.

Feature (utils/compliance, pure-stdlib)

• build_compliance_report(evidence, frameworks=None): maps a flat evidence mapping of observed facts to a catalogue of SOC2 (CC6.1/CC6.3/CC6.8/CC7.3/CC8.1) and ISO 27001 (A.5.23/A.8.16/A.8.30) controls — each satisfied (truthy), gap (explicitly falsy), or not_assessed (key absent), so a partial evidence dict yields an honest gap analysis. The evidence keys map to features already shipped this round: egress allowlist, JIT leases, maker-checker approval, secrets scan, audit logging, CycloneDX SBOM.
• render_compliance_html (standalone HTML table) + write_compliance_report (json|html). It is a reporting aid, not a certification — it records asserted evidence, it does not verify the controls.
• Executor AC_compliance_report (evidence as JSON object or builder JSON string; optional frameworks list/comma-string + path/fmt); MCP ac_compliance_report; Builder under Report.

Verification

• 9 tests pass (all-satisfied, gap+not_assessed, framework filter, HTML render, json/html write, unknown-format raises, executor round-trip, wiring, facade); ruff clean; radon no CC≥C; bandit clean; PySide6-free.
• Rebased cleanly onto dev after the trajectory-eval (Add agent trajectory evaluation against declarative rubrics #244) merge.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 33 complexity · 0 duplication

Metric	Results
Complexity	33
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud