Control-path graph (the BloodHound-style layer, in-process on petgraph).
Nodes are security principals; a directed edge A -> B means "A holds a primitive
that lets it control B". We seed Tier-0 (Domain/Enterprise Admins, DC computers,
the domain head) and do a reverse traversal to find every principal that can reach it.
Each edge carries a weight; the cheapest path is the attacker's likely route.