feat: add canonical per-solution controls-covered.json export

[judeper]

Summary

Addresses framework finding U-050 (P2) — adds canonical per-solution control-coverage export so customers and the framework can answer "which controls does Solution X implement?" without manual maintenance.

Changes

• scripts/controls-covered.schema.json — JSON Schema (v1.0.0) defining the per-solution export format with full/partial coverage levels
• scripts/build-manifest.py — new emit_controls_covered_json() emitter; wired into the build pipeline with --check drift detection
• <slug>/controls-covered.json × 36 — generated per-solution control maps

Example output (action-confirmation-auditor/controls-covered.json)

{
  "schemaVersion": "1.0.0",
  "generatedBy": "scripts/build-manifest.py",
  "solutionId": "action-confirmation-auditor",
  "solutionName": "Action Confirmation Auditor",
  "solutionVersion": "1.2.1",
  "status": "live",
  "controls": [
    { "id": "2.12", "coverage": "full" },
    { "id": "1.10", "coverage": "full" }
  ],
  "controlCount": 2
}

Acceptance criteria from #163

• Schema defined for per-solution control coverage
• All 36 solutions emit a controls-covered.json
• Framework's solutions-lock.json consumes from solution exports (framework-side — separate PR)
• Framework page lists per-solution control count (framework-side — separate PR)

Validation

• python scripts/build-manifest.py --check passes (zero drift)
• python -m pytest scripts/tests/ — 30/30 tests pass

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 06a3882ec5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor partial coverage when emitting controls-covered.json

Do not hardcode coverage to "full" for every control here, because this makes the new export inaccurate as soon as a solution only partially implements a control. The schema and docs explicitly model full|partial, but this emitter currently cannot produce partial, so downstream consumers will overstate implementation strength for those solutions.

Useful? React with 👍 / 👎.