docs: add NIST CSF tier evidence gates

[catcherintheroad-hub]

Created from review issue: #1409

Summary

• Separate subcategory maturity scoring from organizational NIST CSF Tier assessment
• Add organizational Tier evidence gates and cap rules for risk management process, integrated risk program, external participation, and adaptive feedback
• Add edge-case fixtures that prevent average-score inflation into Tier 3 or Tier 4 without GOVERN and adaptive evidence

Validation

• git diff --check
• Markdown fence balance and ASCII check for touched files
• Reference URL checks for NIST Cybersecurity Framework 2.0 and the official NIST CSF 2.0 PDF