Add regulatoryMappings[] for flexible cross-framework mapping (R155, ISO 21434, CRA, ...)

[JohnASRG]

Motivation

Rather than embedding regulation-specific fields directly on every RDX object (which couples the schema tightly to today's regulations and rots as new ones land), provide a generic regulatoryMappings[] mechanism that links RDX objects to clauses/requirements of any framework. This complements #47 which adds a regulatoryCompliance evidence object for R155/R156 specifically — this issue is the mapping substrate.

Proposed change

Add a top-level regulatoryMappings[] to riskSet:

{
  "id": "REG-R155-001",
  "framework": "UNECE R155" | "UNECE R156" | "ISO/SAE 21434" | "ISO/SAE PAS 8475" | "EU CRA" | "NIST SSDF" | "...",
  "frameworkVersion": "2024",
  "requirementRef": "Annex 5 / threat 4.3.6",
  "requirementText": "(optional inline text)",
  "mappedObjectRefs": ["TS-001", "CTRL-001", "DET-001"],
  "evidenceRefs": ["ART-TEST-001"],
  "complianceStatus": "compliant" | "partially-compliant" | "non-compliant" | "not-applicable",
  "rationale": "..."
}

Document standard framework values but accept open strings so jurisdictions/customers can add their own. Add relationship types mapsTo and evidencedBy.

References

• AI peer review, section 6 (R155) and section 8 (CRA)
• Related: #47 (regulatoryCompliance for R155/R156/SUMS)

Acceptance criteria

• regulatoryMappings[] added to JSON Schema + XSD
• Example demonstrates the same control mapped to both an R155 Annex 5 entry and an ISO 21434 clause
• methodology/ adds a short page on the mapping convention
• Backwards compatible — no existing field changes

---

Surfaced by external AI peer review; see chat transcript for full review text.