feat: Safety Manager + Traceability + PlantUML in CI

- Implement Safety Manager (SWA-001, ASIL-D): Hill-Hold + Auto-Apply
  state machine, 13 unit tests
- Update SWA-002 + SWA-001 link coverage so all SWE reqs are covered
- New tool: tools/traceability.py — Markdown-frontmatter-basierter
  Traceability-Checker + HTML/JSON-Matrix-Generator (Doorstop-Format ohne
  Doorstop-Dependency)
- New tool: tools/render_plantuml.py — extrahiert PlantUML-Bloecke aus
  arch/**.md und rendert via plantuml.com zu SVG
- validate.yml: neue Steps Traceability-Check, Matrix-Publish, PlantUML-
  Render; uploaded als Gitea-Artefakte

.gitea/workflows/validate.yml

@@ -23,7 +23,6 @@ jobs:
             lcov \
             python3 python3-pip \
             git ca-certificates
-          pip3 install --break-system-packages doorstop || pip3 install doorstop || true
 
       - name: Static Analysis (Cppcheck)
         run: make static
@@ -38,11 +37,14 @@ jobs:
       - name: Coverage Report
         run: make coverage
 
-      - name: Doorstop Check
-        run: |
-          if [ -f .doorstop.yml ]; then
-            doorstop || echo "Doorstop check produced warnings"
-          fi
+      - name: Traceability Check
+        run: python3 tools/traceability.py check
+
+      - name: Traceability Matrix publishen
+        run: python3 tools/traceability.py publish docs/traceability
+
+      - name: PlantUML Diagramme rendern
+        run: python3 tools/render_plantuml.py
 
       - name: Upload Coverage HTML
         uses: actions/upload-artifact@v3
@@ -51,6 +53,20 @@ jobs:
           name: coverage-html
           path: build/coverage-html/
 
+      - name: Upload Traceability Matrix
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: traceability
+          path: docs/traceability/
+
+      - name: Upload Architektur-Diagramme
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: architecture-diagrams
+          path: docs/diagrams/
+
       - name: Upload Test Results
         uses: actions/upload-artifact@v3
         if: always()