docs(compliance): CRA Annex I Part I requirements and the release assessed

[devGregA]

Description

Documents the EU CRA Annex I Part I requirements in the CRA and DORA Evidence Packs page (docs/content/federal_compliance/eu_evidence_packs.md, English only; the page has no translations).

• The CRA catalog now includes the 13 Annex I Part I product security requirements (PI-1, PI-2(a) to PI-2(m)). New CRA assessments include them, and existing CRA assessments pick them up on their next recompute.
• How an assessor records applicability: Not Applicable with the justification (the reason field is labeled "Why This Requirement Does Not Apply"), or a state plus an implementation narrative, which is required before a Part I requirement can be set to Satisfied or Partially Satisfied by hand, plus supporting files.
• What automation does: PI-2(a) checks open and risk-accepted findings flagged as known exploited (CISA KEV); the ten CWE-mapped requirements can only flag gaps and are never marked met; findings without a CWE are counted for coverage. The CWE sets are listed.
• The new "Release Assessed" field, how to set and edit it, and where it appears in the evidence pack (workbook Cover and the OSCAL result).
• Two troubleshooting rows, and the start-dialog text updated for the release field.

The Pro change is a private PR; merge the two together.

🤖 Generated with Claude Code