Policy ↔ Control Coverage

Coverage traversal: policies → controls → risks. Gaps surfaced.