docs: stable per-control anchors in compliance mappings so external standards can deep link

## Problem

We are mapping the AGT control set into [OpenCRE](https://opencre.org) so that AGT controls cross-link to ASVS, CWE, ISO 27001, NIST 800-53, SAMM and the OWASP AI Exchange without anyone maintaining pairwise mappings.

OpenCRE links to a specific control at a stable URL, and regenerates those links from its API in CI. The OWASP AI Exchange already does this: its rate-limiting section carries auto-generated links to the matching CRE and onward to NIST and MITRE.

We cannot receive that link today. Our compliance docs render as long pages with no stable per-control anchor, so the best an external standard can do is link to the top of the file.

## What is needed

Stable, durable anchor IDs per control in the two docs that carry the control taxonomy:

- `docs/compliance/atf-conformance-assessment.md` — the 25 ATF requirements (`I-1` … `R-5`)
- `docs/compliance/owasp-asi-policy-mapping.md` — the named policy rules

So `#i-3-ownership-chain` resolves and keeps resolving. The requirement is durability, not prettiness: OpenCRE's whole value is that links do not rot, so an anchor that changes when the heading is reworded is worse than no anchor.

## Why it matters beyond OpenCRE

Any external framework that wants to reference a specific AGT control has the same problem. This is the general fix, OpenCRE is just the first consumer.

## Not in scope here

The mapping content itself. That is being worked separately with the OpenCRE maintainers.

Start with docs/compliance/atf-conformance-assessment.md and docs/compliance/owasp-asi-policy-mapping.md, reviewing the 25 ATF requirements and named policy rules. Add durable per-control anchor IDs, including the I-3 example, and verify that each control can be reached through a stable fragment URL without changing the mapping content.

Written by the indexing model from the issue text.