[sc2ben]

Upstream restructured the workbook again, which broke the autopilot validation
gate (issue #4). The parser now reads 2026.1.1, 2026.2 and 2026.3 from one code path:

• Risk/threat likelihood matrix. The two per-control summary columns are gone;
  each control now rates every risk (65) and threat (45) as Unlikely, Possible
  or Likely. controls[].risks / threats keep their id-list shape and hold the
  ids rated Possible or Likely. New additive fields risk_likelihood and
  threat_likelihood carry every rating ({id: rating}). A rating outside that
  vocabulary fails the gate (likelihood-value).
• Compensating controls moved inline. The separate tab is gone; the same
  columns now sit on the control tab. Output shape is unchanged.
• Smaller header changes: Documentation Artifact is now ERL Artifact, the
  Organization Defined Parameters column became Notes (still emitted as
  org_defined_parameters), and the risk catalog gained an Old Risk # column.
• The MON-03.3 evidence-request typo is fixed upstream, so its override is now
  scoped to 2026.1.1 and 2026.2.

[tsunaminoai]

Reviewed non-generated file edits. Looks good.