Keep review obligations visible and reconcile owner evidence (RISK-WP-0006, RISK-WP-0007)

check_all runs every check stage even when one fails; malformed dates are
reported rather than aborting; accepted findings and closure evidence are
shown; defer requires a valid future date. Adds SCOPE.md, the scope
assessment, the open-findings source review and a unittest suite. Stops
tracking __pycache__.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89

tools/register_lib.py

@@ -82,7 +82,7 @@ def regulatory() -> list[dict]:
     d = REPO / "docs" / "regulatory"
     if not d.exists():
         return []
-    return sorted((load(p) for p in d.glob("*.md") if p.name != "README.md"),
+    return sorted((load(p) for p in d.rglob("*.md") if p.name != "README.md"),
                   key=lambda r: r.get("id", ""))
 
 
@@ -112,7 +112,12 @@ def moment(value) -> dt.datetime | None:
     if isinstance(value, dt.date):
         return dt.datetime.combine(value, dt.time(0, 0), tzinfo=dt.timezone.utc)
     if isinstance(value, str) and value not in ("", "unset"):
-        return dt.datetime.fromisoformat(value.replace("Z", "+00:00")).astimezone(dt.timezone.utc)
+        try:
+            parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00"))
+        except ValueError:
+            return None
+        return (parsed.replace(tzinfo=dt.timezone.utc) if parsed.tzinfo is None
+                else parsed.astimezone(dt.timezone.utc))
     return None