AssessmentFinding.log references a non-existent EvaluationLog entry

[jpower432]

Version of Gemara

main at 24e52e9

Describe the bug

AssessmentFinding.log is documented as mapping to the EvaluationLog entry containing the finding, but it is an EntryMapping and therefore requires entry-id. #ControlEvaluation, the entry type in #EvaluationLog.evaluations, has no id; it only has name, which is neither constrained as unique nor required to be non-empty.

The enforcement fixture uses control identifiers such as OSPS-DO-01 as log.entry-id, but the corresponding evaluation has no such entry identifier. The reference therefore hangs: consumers cannot determine which ControlEvaluation it denotes.

To Reproduce

1. Inspect #AssessmentFinding.log in enforcementlog.cue:61-74.
2. Inspect #ControlEvaluation in evaluationlog.cue:18-32; it has no id, and name: string has no uniqueness or non-empty constraint.
3. Compare test/test-data/good-enforcement-log.yaml:59-61 (entry-id: OSPS-DO-01) with the EvaluationLog fixture. The matching control is at test/test-data/pvtr-baseline-scan.yaml:300-322; its ControlEvaluation.name is empty and it has no id.

Expected behavior

AssessmentFinding.log must be able to identify a concrete evaluation result in the referenced EvaluationLog. The schema should provide a stable identifier for the target entry and document which evaluation level the finding reference selects.

Screenshots

No response

Additional context

This does not propose cross-artifact dereference or artifact-type validation; Gemara does not generally enforce those. Relevant primitives: mapping_inline.cue:47-57.