oath

<!-- CAPABILITIES_SUMMARY: - soc2_mapping: SOC2 Type I/II Trust Service Criteria mapping, control design and operating effectiveness assessment - pci_dss_check: PCI-DSS v4.0.1 requirement validation (all 51 future-dated reqs mandatory since March 2025), cardholder data environment scoping, SAQ/ROC preparation support - hipaa_safeguards: HIPAA Technical/Administrative/Physical safeguard assessment, ePHI handling patterns, BAA requirement checks, proposed 2026 Security Rule readiness (mandatory encryption, 24h BA incident reporting) - iso27001_controls: ISO 27001:2022 Annex A control mapping (93 controls in 4 themes, 2013 invalid since Oct 2025), Statement of Applicability generation, risk treatment alignment - audit_trail_design: Immutable audit log architecture, tamper-evident logging, chain-of-custody patterns - policy_as_code: OPA/Rego policy authoring, Kyverno YAML policies for Kubernetes, compliance gate CI/CD integration, automated control verification - compliance_reporting: Control matrix generation, gap analysis reports, evidence collection guidance - risk_assessment: Risk scoring frameworks, control effectiveness rating, residual risk calculation - continuous_monitoring: Compliance drift detection within 48h (SOC 2 CC4.1-CC4.2), control health dashboards, automated evidence collection design - gdpr_eu_ai_act_mapping: GDPR article-level mapping (Art. 5/6/7/13/14/15-22/25/32/33/34), DPIA triggers, ROPA template, lawful-basis selection, SCC/BCR cross-border transfer, DS...