Add CVE compensating-control exploit-path gates

[Desalzes]

Summary

Fixes #1629.

This strengthens cve-triage so compensating controls cannot lower a CVE SLA unless they are proven to block the specific exploit path for the affected deployment. Generic mitigations such as WAF, segmentation, EDR, disabled features, or VEX statements now need scoped evidence before they count as de-escalation factors.

Changes

• Added a compensating-control exploit-path verification step before SLA assignment.
• Required control-to-vector mapping, exploit prerequisite coverage, fleet/runtime scope, effectiveness evidence, bypass review, owner, expiry, monitoring, and rollback criteria.
• Added CVE-COMP-01 through CVE-COMP-05 finding IDs for weak compensating-control evidence.
• Added a Compensating Control Verification report table and a Compensating Control Gaps output field.
• Added a common pitfall warning against generic SLA reductions from unproven mitigations.

Validation

• git diff --check
• frontmatter required-field check
• prompt-injection pattern scan for the modified skill
• markdown fence balance check