Work the register due list, and add the one-check-per-sitting rule

Nine records checked. Five clean and climbed to 1h: RISK-F-0003, 0004,
0005, 0006, 0009 and RISK-REG-0001. Three moved and stay at instant —
RISK-F-0002 (RISK-V-0001 found the flex-auth-ops-warden policy admits no
ingress, so the live question there is now availability rather than
attestation), RISK-F-0007 (the on-request path walked for the first time
as RISK-V-0002), RISK-F-0008 (the determination now exists).

The rule: a finding recorded as moved is not clean-checked in the same
sitting. Re-reading your own keystrokes and climbing produces a rung that
says the world held still when what held still was the last five minutes.
The rung carries stability information or it carries nothing.

record_check.py now handles regulatory records as well as findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/record_check.py

@@ -28,7 +28,7 @@ def main(argv: list[str]) -> int:
     if len(argv) < 2:
         fail(__doc__)
     fid, outcome, rest = argv[0], argv[1], argv[2:]
-    matches = [f for f in lib.findings() if f["id"] == fid]
+    matches = [f for f in lib.findings() + lib.regulatory() if f.get("id") == fid]
     if not matches:
         fail(f"no finding with id {fid}")
     f = matches[0]