ISO 27001-aligned recovery kill-chains that withstand regulatory forensics — enterprise resilience sovereign doctrine.