enhancement: declare FedRAMP r5 control-family axis (20 families)

[Daren9m]

Gap

data/frameworks/fedramp.json declares only scoring.profiles (Low / Moderate / High baselines). FedRAMP r5 is built on NIST 800-53 r5 and uses the same 20 control families (AC, AU, IA, …) as controlId prefixes. None are declared in CheckID. Downstream consumers (M365-Assess #843) regex them out of controlId strings.

Families to declare

Identical to NIST 800-53 r5 (#319). Same 20 codes, same display names, same extraction strategy. The values map can be shared/imported from nist-800-53-r5.json once #319 lands — or duplicated for now.

Extraction

Same as 800-53: 2-letter family code + - (e.g. AC-1, IA-5(7)). Strategy: letter-prefix-before-dash.

Acceptance criteria

• Spike spike: multi-axis taxonomy schema for frameworks #317 resolved
• data/frameworks/fedramp.json declares the family axis per agreed shape
• Values map matches nist-800-53-r5.json (or references it, if the schema supports cross-framework references)
• Pester validation confirms every FedRAMP controlId in data/registry.json resolves to a declared family
• Existing scoring.profiles (Low/Mod/High) coexists with the new axis (or migrates to baseline per spike outcome)

Blocked by

Spike #317. Likely lands in the same PR as #319 since the data is identical.

Related

#319 (NIST 800-53 r5).

[Daren9m]

Subsumed by #407 — covered by the 13-framework seed data. Will auto-close when #407's seed-data PR merges (via closes #320 in the PR body). Tracking comment for audit trail.