pub fn compliance_controls() -> Vec<Box<dyn Control>>
Returns compliance controls (non-SLSA, SOC2/ASPM mapped).