[WM-BW-5] SAP and SAR generated independently with no structural linkage (SP 800-53A)

## WM-BW-5 — SAP-to-SAR Traceability Missing

**Category:** Broken ATO/RMF Workflow | **Priority:** High
**Regulation:** SP 800-53A

### Observation
SAP and SAR are generated as independent documents with no foreign key or structural linkage between them. SP 800-53A requires that SAR findings be traceable to specific SAP test procedures.

### Evidence
- SAP generation broken (issues #624, #630)
- No SAP-to-SAR FK observed in data model

### Impact
Assessment results cannot be traced to their originating test procedures. SAR findings are unverifiable against the approved assessment plan, which invalidates the assessment for ATO purposes.

### Acceptance Criteria
- [ ] SAR finding record includes FK to originating SAP test procedure
- [ ] SAP test procedures include unique identifiers referenced in SAR
- [ ] Exports surface the traceability linkage
- [ ] SAP generation fixed (ref #624, #630)