feat: Add SDK API and fix critical inconsistencies (v1.7.2)

[had-nu]

Summary

This PR introduces a programmatic SDK for Wardex that enables security engineers to integrate compliance gap analysis into custom tools, CI/CD pipelines, and automated workflows without relying on CLI invocations.

Changes

New Feature: SDK API (pkg/sdk/)

• sdk.Analyze(controls, framework) - Run compliance assessment
• sdk.LoadControls(paths...) - Load controls from files (YAML/JSON/CSV)
• sdk.LoadFramework(name) - Load framework catalog
• sdk.Report(result, format, output, limit) - Generate reports
• sdk.SnapshotSave/Load/Diff - Trend analysis

Bug Fixes (Critical)

1. EPSS 1.0 handling - EPSS score 1.0 is valid (100% probability), not "missing"
2. CSV output - Added missing gate decisions and delta sections
3. AggregateLimit - Now used in aggregate mode
4. RBAC consistency - Aligned error messages

Version

Bump: 1.7.1 → 1.7.2

Testing

go test ./...       ✓ All tests pass
go vet ./...       ✓ No static analysis errors
go build          ✓ Compiles successfully

Example Usage

import "github.com/had-nu/wardex/pkg/sdk"

func main() {
    controls, _ := sdk.LoadControls("./controls.yaml")
    result, _ := sdk.Analyze(controls, "iso27001")
    fmt.Printf("Coverage: %.1f%%\n", result.Summary.GlobalCoverage)
}

Files Changed

• pkg/sdk/ (new package)
• examples/sdk/ (new example)
• pkg/analyzer/analyzer.go - Exported with error returns
• pkg/correlator/correlator.go - Exported with error returns
• pkg/report/csv.go - Added gate/delta sections
• pkg/enrich/cli/cli.go - Fixed EPSS handling
• pkg/releasegate/gate.go - Added AggregateLimit
• cmd/evaluate/evaluate.go - Fixed RBAC message
• Tests updated