Improve ISO 27001 SoA risk traceability gates

[danyili2632]

Summary

• addresses [REVIEW] iso27001-gap: add SoA risk traceability gates #1412 by adding SoA risk traceability gates to iso27001-gap
• requires included controls to link to risk, legal, contractual, statutory, regulatory, or business drivers
• requires excluded controls to include scope-specific justification and conformity impact analysis
• adds treatment option, treatment plan, owner, evidence location, residual risk acceptance, approval trail, and weak-record classification checks
• updates the report output with a SoA Risk Traceability table

Validation

• git diff --check
• verified required markers for SoA Risk Traceability, SOA-TRACE checks, driver/linked risk, treatment option, residual risk acceptance, traceability status, and weak SoA records
• verified Markdown fence count is balanced

Bounty

• Target tier: Improver Moderate ($100) if accepted
• Preferred payment method: crypto, Base USDC 0x6CBF4b5cb88b8C2B7af776Bc2B073163B5d3C08A