docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei) (#233)

docs/features/control-mapping.md

@@ -6,7 +6,7 @@ Control mapping connects the scanner's raw output — deterministic tool finding
 
 The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
 
-- A tool (semgrep, gitleaks, syft/osv, ZAP, nuclei) detects deterministically.
+- A tool (semgrep, gitleaks, syft/osv, the PLC linter; the DAST agents today, with **Nuclei and ZAP planned** as deterministic web/OT detectors underneath them — see [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code)) detects.
 - An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
 - The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
 
@@ -34,7 +34,7 @@ At scale, the **master-controls** corpus (breakpilot's deduped clusters, exporte
 
 ```mermaid
 flowchart TD
-    T[Deterministic tools\nsemgrep · gitleaks · syft/osv · ZAP] --> F[Findings]
+    T[Deterministic tools\nsemgrep · gitleaks · syft/osv · DAST · PLC linter] --> F[Findings]
     F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
     F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
     R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]