feat: add cybersecurity engineering package

[joey-huckabee]

Summary

• add authoritative source register and schema-validated OSCAL component definition with deterministic SCTM/human views
• add architecture, threat model, cryptographic boundary, vulnerability/exception, incident, and inherited-responsibility documentation
• add native amd64/arm64 report-only SCAP discovery over never-executed owner-preserving exports
• record crypto linkage evidence and enforce official OSCAL schema validation in CI

Claims boundary

• no system authorization, compliance, STIG certification, or FIPS claim
• all initial control classifications remain pending independent review
• SCAP findings remain report-only; scanner and evidence errors are blocking

Validation

• official OSCAL 1.2.3 component schema validation
• 19 unit tests
• pre-commit (JSON/YAML, actionlint, shellcheck, hadolint, formatting)
• private vulnerability reporting API returned enabled