fix(audit): evaluate only the audited framework's controls (#442)

[mlieberman85]

Summary

Controls live in a process-wide registry keyed by control id. Each audit registered its framework's controls and then evaluated everything the registry held, so a long-lived process (the MCP server) mixed frameworks. Reproduced on main:

Audit, in order	Controls before	Controls after
reproducibility (fresh process)	5	5
openssf-baseline	71 (5 of them RE-)	66 (65 OSPS + the STAGE1 reference control, #466)
reproducibility again	71 (65 of them OSPS)	5

With this change, run_sieve_audit loads an audit's controls from its own framework definition (including composed controls) plus operator custom controls. It falls back to the registry only when no framework definition resolves. Registration into the registry is unchanged for its other consumers.

docs/architecture/framework-design.md section 6.3.1 states the rule and adds a scenario.

Closes #442

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Testing

• Tests pass locally (uv run pytest tests/ -v): 5112 passed, 26 skipped
• Added tests for new functionality (if applicable): tests/darnit/tools/test_audit_control_scope.py. It runs reproducibility, then baseline, then reproducibility in one process, offline through RecordedGhApi, and failed before the fix.
• Linting passes (uv run ruff check .)

Also passing: the integration tests with GitHub Actions environment variables set (334 passed) and the false-PASS corpus gates.

AI assistance

• No AI assistance was used
• AI assistance was used

Claude (Claude Code, claude-opus-5-5) reproduced the issue and made the fix and test. This description was also drafted with Claude. The commit carries an Assisted-by: Claude:claude-opus-5-5 trailer.

Additional Notes

• tests/darnit/sieve/baseline_capture.py still runs each pair in a subprocess, the Controls leak across frameworks within a process: reproducibility audit returns 71 controls instead of 5 after a baseline audit #442 workaround from feature 037. It can switch to in-process capture in a follow-up.
• The test suite's autouse registry-restore fixture (tests/conftest.py) can stay as defense in depth.

🤖 Generated with Claude Code