v0.4.0 — Defensive control catalogue + OWASP GenAI Data Security lens

Completes the Tier 2 purple-team set: pairs the red-team test plan with its defensive counterpart and adds a data-layer security lens.

Added

Defensive control catalogue (controls report · MCP generate_control_catalog) — the blue-team mirror of the red-team test plan. A prioritised, architecture-aware catalogue of the controls to implement per in-scope OWASP LLM risk: what to implement, what it prevents, how to verify it, the NIST CSF 2.0 / ISO 27001:2022 anchors and the EU AI Act / NIST AI RMF references. A control's priority is the architecture-aware severity of the risk it mitigates (the same number the red-team plan uses), conditional controls are gated on the same architecture conditions as the offense, and each control names the red-team test case(s) that verify it — implement, then test.

OWASP GenAI Data Security lens (datasec report · MCP assess_data_security) — maps the system to the 21 OWASP GenAI Data Security risks (DSGAI01–21, from the 2026 v1.0 guidance), the data-layer complement to the OWASP LLM Top 10 lens. Deterministic relevance over the intake; each applicable risk is cross-mapped to the OWASP LLM Top 10, EU AI Act Art. 10 (data governance), the GDPR and NIST AI RMF.

Both wired into the CLI (--type controls|datasec), the web UI (two tabs), the MCP server and the assessment skill. DESIGN.md + README updated. Identifiers verified against genai.owasp.org; cross-framework mappings are Companion-derived analytical alignments, labelled as such.

Tests: +20 (80 total), covering determinism, severity-driven priority, architecture gating, the free-text injection invariant, the offense↔defense cross-link integrity, DSGAI knowledge-base fidelity (21 ids), coverage consistency and rendering. ruff + bandit clean.

Full changelog: https://github.com/JKasteele/ai-act-companion/blob/main/CHANGELOG.md