Closes #1124.

Adds explicit CC9.2 handling for subservice organizations and complementary user entity controls in the SOC 2 gap skill.

What changed:

• Adds vendor SOC 2 report, bridge-letter, system-description, and CUEC prerequisites to the readiness workflow.
• Adds roadmap and output requirements for subservice organization treatment, CUEC ownership, complementary subservice controls, and period-gap handling.
• Adds a dedicated subservice-cuec-evidence.md reference with SOC2-SUB-01 through SOC2-SUB-06 checks, scoring guidance, and benign/vulnerable readiness packet examples.
• Keeps vendor reports and CUEC text classified as evidence, not executable instructions, in the prompt-injection safety guidance.

Validation:

• git diff --check
• confirmed Markdown fence balance for changed files
• confirmed SOC2-SUB-01 through SOC2-SUB-06 markers are present
• confirmed the new reference file is ASCII-only

Submitting this as an Improver contribution. Payment details can be handled privately after maintainer acceptance.