[Documentation] path-to-authorization.md advertises FedRAMP Moderate baselines for the SCTM and Policies and Procedures templates, but the published template set is FedRAMP High and IL5 only

## Description of Documentation Need

`docs/path-to-authorization.md` presents the authorization-package templates as covering three baselines. At `main` @ `6d7d08c0`:

* **Line 3**, the document subtitle: `Impact Level 5 (H-H-X), FedRAMP High & FedRAMP Moderate`
* **Lines 70-71**: a link labeled `FedRAMP High & Moderate Authorization Boundary`
* **Lines 113-114**: `Security Control Traceability Matrix (SCTM) Templates` — `(IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)`
* **Lines 116-117**: `Policies and Procedures Templates` — `(IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)`

**No Moderate baseline appears to exist for any of the authorization-package artifacts.**

**The two families that live in this repository can be checked directly** — `git ls-tree -r main -- docs/artifacts/` at `6d7d08c0` returns four template files and no others:

```
docs/artifacts/hw-sw-list/FedRAMP_High_HWSWList_Template.xlsx
docs/artifacts/hw-sw-list/IL5_HWSWList_Template.xlsx
docs/artifacts/ppsms/FedRAMP_High_PPSMBoundariesInformationExport_Template.xlsx
docs/artifacts/ppsms/IL5_PPSMBoundariesInformationExport_Template.xlsx
```

Two regimes, no Moderate.

**The remaining families are not in the repository at all** — there is no System Security Plan template, no SCTM template and no Policies and Procedures template anywhere in the tree. Those are hosted on Drive, in the **ATO Artifacts** folder this document's template links resolve to:

> https://drive.google.com/drive/folders/1NeWZcOuxysi7kUNRCFDd8CeHnxF14ywp

Every family in it is the same two regimes:

| Family | What is there | Moderate? |
|---|---|---|
| **Policies and Procedures** | subfolders `FedRAMP High` (20 documents) and `IL5`, plus the *Policies and Procedures User Guide* | no |
| **SSP** | `FedRAMP_High_SSP_System Security Plan_Template`, `IL5_SSP_System Security Plan_Template` | no |
| **SCTM** | `SCTM_Burndown_Tool_rev5_FedRAMP_High`, `SCTM_Burndown_Tool_rev5_IL5_HHX` | no |
| **PPSM** | the same `FedRAMP_High` / `IL5` pair also committed to `docs/artifacts/ppsms/` | no |

The Policies and Procedures set is the one line 116 sends a reader to, and it is the largest of the families — twenty documents per regime, one per 800-53 control family, named `___Rev<#>_Template` (for example `FedRAMP_High_AC_Access Control_Rev5_Template` and `IL5_HHX_AC_Access Control_Rev5_Template`). There is no `FedRAMP Moderate` subfolder beside them.

So across both hosting locations, and across all five artifact families, the only values of `` in use are `FedRAMP_High` and `IL5` / `IL5_HHX`.

So a reader who follows this document to assemble a FedRAMP Moderate authorization package is told the Moderate baselines exist and then cannot find them.

This became more visible with `v3.0.0`. Platform-level FedRAMP Moderate support landed in PR #162 (closing #101): `kms_protection_level` became a variable across `0-bootstrap`, `1-resman`, `2-networking` and `3-security`, and the networking stage is now "FedRAMP High / Moderate". An operator can therefore stand up a Moderate landing zone today, and then finds neither a Moderate workload blueprint (#192) nor a Moderate authorization package.

## Target Audience

Anyone assembling an authorization package for a FedRAMP Moderate system: SSP authors, ISSOs and ISSMs, the partners this template set exists to accelerate, and the Authorizing Official who receives the package. Also anyone doing regime selection early in a program, where "is the paperwork ready for Moderate?" is a real input to choosing Moderate over High.

## Proposed Location

`docs/path-to-authorization.md` — the four places listed above. Whatever indexes the template set itself should carry the same statement, so the document and the deliverable cannot drift apart again.

## Content Outline / Draft

Correct the four references to name the baselines that are actually available — IL5 (H-H-X) and FedRAMP High — and add one sentence on whether Moderate is planned. A statement of intent is genuinely useful on its own: a team choosing between High and Moderate can plan around "Moderate templates are not available yet," but cannot plan around a promise that does not resolve.

Stating the regimes each artifact family covers *at the point of the link* is what stops this recurring. Today the coverage claim appears only in the subtitle and in two parenthetical notes, and the System Security Plan link at line 85 carries no regime note at all, so its coverage has to be inferred from the subtitle.

## Compliance Context (if applicable)

No control is mis-implemented — this is a documentation-coverage question rather than a control gap. It matters because these are the artifacts an assessor asks for by name: the System Security Plan (PL-2), the traceability matrix that carries control assessment and continuous monitoring (CA-2, CA-7), and the per-family policy and procedure documents required by the `-1` control of every 800-53 family (AC-1, AU-1, and so on for all twenty). A Moderate baseline is not a subset of High that a team can safely tailor down by hand: the control selections differ, and starting from the High templates and deleting controls is exactly the kind of undocumented tailoring that costs time in assessment. FedRAMP Moderate is also the larger share of federal and state workloads, so the audience for these artifacts is bigger than the audience for the High ones.

Open docs/path-to-authorization.md and review the subtitle and the references around lines 70-71, 85, and 113-117. Update the coverage statements to match the available IL5 and FedRAMP High templates, state whether Moderate templates are planned, and check any index for the template set so its coverage description stays consistent.

Written by the indexing model from the issue text.