docs(crosswalk): NIST SP 800-53 Rev 5 and DoD AI Tailoring Guide mapping for v0.2 claims

[antagoninc]

What: Adds docs/crosswalks/nist-sp800-53-dod-ai-tailoring.md, an informative mapping from each TRACE v0.2 Trust Record claim to the NIST SP 800-53 Rev 5 controls it is evidence for, with what each claim establishes, what the assessor still needs, and the item in the DoD CIO AI Cybersecurity Risk Management Tailoring Guide (v2, July 2025) it answers. Adds the nav entry and a CHANGELOG line.

Why: US federal and DoD AI systems are authorized under RMF. Assessors ask which controls a record evidences; the Tailoring Guide names the controls (SI-7, SR-4, AU-9(3), SA-11, CA-7) but not how a signed runtime record satisfies them. The page also states plainly what a record does not evidence for an authorization package: TEVV results (a v0.2 record can only point at them via references with rel condition-appraisal / authorized-intent), control implementation across the boundary, and non-repudiation against an operator-held key.

Type: Informative addition, no sponsor required per CONTRIBUTING.md. No schema, wire-format or normative change. Commits signed off.

[imran-siddique]

Checked against main: every field, section and default the page cites is there, including the eat_profile constant, §3.1.3 to §3.1.5, §3.2.3 and the 24-hour and 5-minute freshness bounds. I did not check the Tailoring Guide's section numbers against the PDF.

Two mechanical fixes before merge. test (3.11) fails at the house-style step on the five table cells that hold an em dash (the last column of the origin, reproducibility, iat, TraceRevocation/1.0 and delegation rows); n/a works there. And please drop the CHANGELOG.md hunk: entries are written at merge here so open PRs stop conflicting on it. I will merge once the tests pass.