Software system that uses a language-model agent to assess the security of a cloud computing environment using only read-only evidence queries, verifies every cited query and observation time before accepting the assessment, and supports remediation verification, authorisation packages and continuous authorisation