CMMC Level 2 control mapping (110 practices)

[rudymartinezai]

Goal

Add CMMC Level 2 compliance framework (full NIST 800-171 alignment).

Depends on

• CMMC L1 issue (multi-framework engine must be in place)
• Historical scan storage

New capabilities needed

• MANUAL control status for non-automatable checks
• POA&M report output
• Audit logging verification checks

Acceptance Criteria

• klustershield scan --framework cmmc-l2 works
• All 110 practices mapped
• POA&M report exported