[Epic]: SOC 2 Type II readiness programme

## Summary
Stand up a SOC 2 Type II readiness programme: map controls to the Trust Services Criteria, collect 6-12 months of operating-effectiveness evidence, and run a scoped penetration test with documented remediation and retest.

## Intent / Source of truth
SOC 2 Type II is the single most-requested artifact in enterprise security review. Type II requires evidence of operating effectiveness sustained over 6-12 months across 64+ control points — a Type I point-in-time report will not clear the bar. The lead time means this must start now regardless of feature work. Source: 2026-08-13 enterprise-readiness research pass.

## Scope
- [ ] Control framework mapped to the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy as applicable) across 64+ control points
- [ ] 6-12 month operating-effectiveness evidence-collection pipeline (not just point-in-time screenshots)
- [ ] Scoped penetration test mapped to the Trust Services Criteria, within the audit period
- [ ] Documented remediation and retest for every finding

## Out of scope
- Engaging the actual external auditor firm (a commercial/legal decision, not an engineering deliverable) — this epic covers readiness, not the audit engagement itself

## Verification
A control-evidence repository with continuous (not one-off) evidence for each of the 64+ controls, spanning at least one full 6-month window before audit engagement; penetration test report with all findings remediated and retested.

## Risk assessment
Starting evidence collection late is the single biggest risk to the whole M6 milestone's timeline — a Type II audit period cannot be compressed after the fact, so any delay here delays the earliest possible SOC 2 report date by the same amount.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.