Jurisdiction risk flag

Identifies governing law and flags jurisdiction specific compliance exposure, such as GDPR, CCPA, or local labor law.