Add export control, childrens data, audit assurance, and whistleblower compliance policies

[phertyameen]

Summary

Adds four compliance governance documents, all self-contained inside
Governance/compliance/. Each is a versioned policy with an owner, review
cadence, and change log, consistent with the existing Governance/ documents.

File	Covers
Governance/compliance/EXPORT_CONTROL.md	Export control posture, cryptography, and sanctions screening for funded activity.
Governance/compliance/CHILDRENS_DATA.md	What the project does when data concerns a child, and remediation.
Governance/compliance/AUDIT_ASSURANCE.md	Internal and third-party assurance of security, privacy, and governance controls.
Governance/compliance/WHISTLEBLOWER.md	How to report wrongdoing, reporter protection, and how reports are handled.

Scope

• Documentation only. No TypeScript, configuration, schema, or dependency is
  touched.
• All changes live under Governance/compliance/; nothing outside Governance/
  is modified.
• Governance/ is outside the Jest root and the TypeScript build, so no test,
  build step, or runtime path is affected.

Notes

• Regression tests are not applicable: this is a documentation-only change with
  no executable code.
• Cross-references point at existing Governance/ documents
  (compliance/SANCTIONS.md, SECURITY_POLICY.md, CODE_OF_CONDUCT.md,
  policies/TRANSPARENCY_REPORTS.md, and others).

Closes #1879
Closes #1881
Closes #1882
Closes #1883

[drips-wave]

@phertyameen Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.