Address copilot pass 7 on #2

- README: "green/red checklist" → "pass/warn/fail/skip checklist".
  The actual UI has four states; binary phrasing was misleading.
- lib/lws-cid.js: skip the self-control comparison when @id is
  missing rather than emitting "@id=null" in a delegated-control
  warning. The earlier "Profile has @id" check has already failed,
  and "controller === @id" isn't meaningful without an @id to
  compare against.

Author: melvincarvalho

README.md

@@ -8,7 +8,7 @@ A diagnostic tool for [Solid](https://solidproject.org/) pods and the surroundin
 
 ## What it does today
 
-**1. LWS / CID v1 profile shape check** — drop in a WebID URL, get a green/red checklist of what's structurally there and what's missing for [LWS 1.0](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth conformance:
+**1. LWS / CID v1 profile shape check** — drop in a WebID URL, get a pass/warn/fail/skip checklist of what's structurally there and what's missing for [LWS 1.0](https://www.w3.org/TR/2026/WD-lws10-authn-ssi-cid-20260423/) auth conformance:
 
 - Profile fetches as `application/ld+json`?
 - `@context` declares the CID v1 vocabulary (controller, verificationMethod, authentication, …)?

lib/lws-cid.js

@@ -96,21 +96,32 @@ export function runLwsCidChecks(profile, { webIdUrl }) {
     // JSON-LD shapes (string, object-with-@id, object-with-id, array)
     // are handled consistently.
     const ctrlList = normalizeControllers(controller, requestedNoHash);
-    const idAbsolute = absolutize(id, requestedNoHash);
     if (ctrlList.length === 0) {
       out.push({
         status: 'fail',
         label: 'Profile declares a controller',
         detail: 'controller is present but does not resolve to a usable IRI.',
       });
-    } else if (ctrlList.includes(idAbsolute)) {
-      out.push({ status: 'pass', label: 'controller === @id (self-controlled)' });
-    } else {
+    } else if (!id) {
+      // @id was missing — already failed earlier. Self-control compares
+      // controller against @id, so it's not meaningful here. Just note
+      // that controller is structurally declared.
       out.push({
-        status: 'warn',
-        label: 'controller differs from @id',
-        detail: `controller=${ctrlList.join(', ')}, @id=${idAbsolute}. Delegated control is allowed by CID v1 but most pods are self-controlled.`,
+        status: 'skip',
+        label: 'controller === @id (self-controlled)',
+        detail: 'Skipped because @id is missing.',
       });
+    } else {
+      const idAbsolute = absolutize(id, requestedNoHash);
+      if (ctrlList.includes(idAbsolute)) {
+        out.push({ status: 'pass', label: 'controller === @id (self-controlled)' });
+      } else {
+        out.push({
+          status: 'warn',
+          label: 'controller differs from @id',
+          detail: `controller=${ctrlList.join(', ')}, @id=${idAbsolute}. Delegated control is allowed by CID v1 but most pods are self-controlled.`,
+        });
+      }
     }
   }