feat: add compliance evidence crosswalks

[Siddhant-K-code]

Description

Adds the isolated agent-strace compliance-report command with versioned evidence crosswalks for AICPA Trust Services Criteria, OWASP Top 10 for Agentic Applications 2026, and the current consolidated EU AI Act.

• uses conservative evidence_observed, risk_signal, gap, and not_assessed semantics
• snapshots flat/workspace stores with bounded strict parsing and event-time windows
• correlates results, recorded authorization, approval context, and retrospective policy outcomes without overstating control conclusions
• emits authoritative privacy-minimized JSON plus location-free SARIF and optional deterministic PDF
• packages mapping digests, source/licensing notices, docs, and examples
• keeps the legacy compliance export schema unchanged and the base package dependency-free
• uses aicpa-tsc as the canonical CLI identifier because no software-mark licensing clearance is present
• bumps the package to 0.92.0

Verification

• Ona repository test task: 1,869 Python tests passed
• VS Code extension: 3 tests passed
• focused compliance suite: 34 tests passed
• independent adversarial security/export probes: 26 passed
• ReportLab 4.0.4 minimum-version PDF render and deterministic output verified
• wheel metadata and bundled manifests/notices verified

Closes #215

[Siddhant-K-code]

Independent review: approved.

Reviewed the framework editions/licensing notices, conservative evidence semantics, event-time snapshot/correlation behavior, authorization provenance, privacy boundary, deterministic digests, SARIF/PDF projections, atomic output handling, package metadata, and documentation. The implementation was revised through adversarial review and now passes 26 targeted security/data-contract probes, the 34-test focused suite, all 1,869 Python tests, and all 3 VS Code extension tests. No unresolved correctness, security, licensing, or compatibility findings remain. Merge remains gated on all hosted checks.