docs(q-and-a): add 12 Kognitos-point cross-references

[smuchow1962]

Summary

Apply 14 operations from the 2026-05-20 Kognitos 12-point audit cycle to docs/q-and-a.md. Tag format is (kognitos point N) — lowercase, integer N, single space separators, end of Answer cell.

• 5 tag-adds to existing rows (Points 8, 11×2, 12×2)
• 9 new rows covering Points 1, 2, 3 (Variant A), 4, 5, 6, 7, 8 (epistemic scope), 9, 10 (Variant A)

Placement follows Option A — distributed by theme to preserve the role-affinity scan. No introductory paragraph about Kognitos per Steve's directive (the parentheticals stand on their own). Boundary-of-the-claim discipline is baked into every drafted cell (institution-side dependencies, epistemic scope, temporal scope named where applicable).

The Point 12 lead-row tag-add also carries Rosanne's tail-sentence pointing at §10.53 / §10.54 / §4.1.3 so a post-quantum-aware reader doesn't read the present-tense integrity claim as time-invariant.

Theme placement

Point	Theme
1	Implementation and operations
2	Implementation and operations
3 (A)	Audit committee and board governance
4	Model risk management and regulatory mapping
5	Model risk management and regulatory mapping
6	Model risk management and regulatory mapping
7	Cryptographic discipline and standards
8 (epistemic scope)	Privacy and data-subject rights
9	Tamper detection and independent verification
10 (A)	Legal evidentiary posture and litigation

Variant B follow-on

Points 3 and 10 ship Variant A today. Variant B follows after PRD-3 lands the Seam D audit.actor.* family and the audit.downstream_action.* family.

Downstream

The herald-website auto-mirrors docs/q-and-a.md into web/src/content/mrm-spec/docs/q-and-a.md via web/scripts/sync-mrm-spec.cjs. The /mrm/docs/q-and-a page picks up the new rows at the next build. No additional website work needed — Dawn confirmed in her dispatch.

Source of record

All cell text was lifted verbatim from the consolidated pack:
E:\dev\MMP.Media\_assistant_drafts\wiki\market-research\2026-05-20-CONSOLIDATED-kognitos-qa-pack-for-steve.md (the "14 operations" section)

That pack composed work from Pearl (12-field schema), Richard (coverage audit), Rosanne (seam inventory + falsification cross-check), and Laura (CHANGELOG narrative for the 4 separate spec changes).

Test plan

• docs/q-and-a.md renders cleanly in GitHub's markdown preview (no broken table rows)
• All 12 Kognitos points are grep-findable as (kognitos point N) (currently: 15 instances across 14 operations; Point 8 appears twice by design — once tag-add, once new row)
• After merge, the herald-website npm run sync-mrm-spec + build picks up the new rows
• The role-affinity filter on /mrm/docs/q-and-a still works against the new rows (their audience icons compose with the existing role-filter toolbar)