COG wizard relationship fix: vulnerabilities → requirements → capabilities now properly linked