v2.7.1 - nine more packs runnable (use this, not v2.7.0)

Same content as v2.7.0, with one fix that matters for every run.

Use v2.7.1. v2.7.0 was tagged straight off main, where action.yml carries image: 'Dockerfile' so that CI builds from current source. That makes a customer run rebuild the container every time instead of pulling the published, signed image. v2.7.1 pins docker://ghcr.io/dnyoussef/guardspine-code-action:2.7.1, the same way v2.6.0 did. v2.7.0 works, it is just slow and does not use the published artifact.

Nine more packs runnable (13 → 22). None removed.

Six of them the dashboard already sold while this engine could not load them: sox-itgc, eu-ai-act, cfr-part-11, gdpr-privacy-by-design, and cmmc-level1 / cpcsc-level1 (enterprise tier). Selecting one produced a warning in the CI log and then a scan governed by default — five generic rules instead of the regime paid for.

If you had one of these selected, your scans were not enforcing it. After upgrading they will, so expect new findings.

Three are new regulated-finance packs whose rules cite the instrument they come from: dora-ict-requirements, nacha-us-payments-requirements, psd2-sca-requirements (aliases dora, nacha, psd2). They map changes to control themes; they do not certify compliance.

Reviewer models now see the policy in every round

Previously only round 1 was shown the rubric while the last round produced the verdict, so a finding had to survive deliberation without the rule that justified it. Deliberation only runs when round 1 disagrees — so the policy was missing in exactly the contested cases.

One rule contract

• enabled: false is now honoured; such rules were previously still enforced
• pattern-less semantic rules now reach the models instead of being dropped
• an invalid pattern fails loudly instead of being laundered into "the model will handle it"

Supply chain

Renderer and catalogue are now one published artifact (guardspine-prompts 0.2.0), exact-pinned and hashed, shared with the dashboard. Shipped packs live in an installed distribution, so a pull request cannot plant a file that passes as a shipped pack.

- uses: DNYoussef/guardspine-code-action@v2.7.1