Read every runtime compliance control's current state (machine feed, bearer token)

Read-only feed for the compliance team's Risk & Controls Registry. Authenticated by a bearer token dedicated to this route, never by a session. Returns one entry per runtime compliance control with its on/off state and the time, operator and note of its latest change, and one entry per allowlisted engineering setting (today aml_rules_enabled, the AML rule engine's switch) with its effective value and source. Answers 503 when the deployment has no token configured, and 401 control_state_feed_token_invalid for a missing, malformed or wrong token.