Add /go/ permalinks for the AgenTrust agentic control set - #39

Why

OpenCRE's CONTRIBUTING.md calls the automated linking method the preferred one, because it is self-maintaining:

you add to the standard a hyperlink reference to the relevant common requirement (e.g. [Restrict XML parsing](https://www.opencre.org/cre/764-507)) in a section on that topic. And then you specify to us at OpenCRE how we can read your source (e.g. Github) automatically to extract those hyperlinks

We committed to that method on OWASP/OpenCRE#1045. It needs one public page carrying the control set with a stable anchor per control. There wasn't one: trace-spec, cmcp, ca2a and agent-manifest are all organized by problem and architecture, so no per-control section existed to point at. This adds the surface.

What

It proposes no new CREs. That follows the rule Rob van der Veer set on OWASP/OpenCRE#1045: OpenCRE organizes requirements that standards state, it does not state them. The first pass proposed 19 new CREs; applied against that rule, all 19 collapsed into links.

Fourteen of the thirty control names carry the AGT ACS enforcement point they apply at (agent_startup, pre_tool_call, output, and so on). That is Rob's own suggestion for making loop placement visible without amending the OpenCRE taxonomy, since a linked standard's control names are displayed as-is. The other sixteen have no single point and are unmarked rather than forced.

Decisions worth a second opinion

• Permalink redirects to an anchor, rather than 30 standalone pages. Same shape as owaspai.org/go/<slug>/. If we later split the controls into their own pages, the cited URL does not change, only the redirect target. That durability is the whole argument in docs: stable per-primitive anchors so external standards can deep link (OpenCRE prerequisite) trace-spec#213.
• One standard, not five. An OpenCRE standard is one document with sections, and these controls span six repos, two of them still private. /go/ is the document.
• The two private ones are included and labelled. Continuous usage control and model weight custody resolve here and will point deeper when those specs are public. Omitting them would misrepresent the control set.

Checked

• 31 HTML files parse with balanced tags, all 30 anchors resolve, sitemap.xml parses
• Every OpenCRE id verified against a crawl of the live graph (522 CREs, 2026-08-24). None invented.
• Reuses design-system.css?v=10 unchanged, so no cache-key churn

Not done

The generator lives outside this repo, so the page and data/agentic-controls.json can drift. Porting it to scripts/ with a --check job, following the render-adoption.mjs pattern, is the follow-up.

Nothing goes to OpenCRE until these URLs resolve. Refs agentrust-io/trace-spec#213, OWASP/OpenCRE#1045.