[WM-BW-1] SSP/SAR/POA\&M packages not bound to a named System Owner at generation

## WM-BW-1 — System Owner Not Bound at ATO Package Generation

**Category:** Broken ATO/RMF Workflow | **Priority:** Critical
**Regulation:** SP 800-37 Rev2

### Observation
Doc generation uses a "first active system" heuristic with no explicit System Owner identity binding. Generated SSP/SAR/POA&M packages carry no named, identity-resolved System Owner.

### Evidence
- Issue #641 — doc generation uses "first active system" heuristic; no owner binding field observed

### Impact
ATO packages are not attributable to a responsible System Owner. They are not acceptable to an Authorizing Official and do not satisfy SP 800-37 Rev2 accountability requirements.

### Acceptance Criteria
- [ ] System Owner field (identity-bound, required) added to system record
- [ ] Doc generation blocks if System Owner is unset
- [ ] Generated package headers include System Owner name and identity reference
- [ ] Existing systems without a bound owner surface a blocking validation error