Classify with the canon governance_and_control tags

'security' warned as an unrecognised family tag; risk, governance,
compliance and audit are the canonical ones and are closer to what this
repo does anyway — it holds risk and judges compliance, it does not
build security.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.repo-classification.yaml

@@ -8,8 +8,10 @@ repo_classification:
   secondary_domains:
     - government
   capability_tags:
+    - risk
     - governance
-    - security
+    - compliance
+    - audit
     - knowledge
   business_stake:
     - technology