Each entry carries what a choice between models turns on: name, description,
criticality, owner, owning team, when it last changed, and the compliance frameworks
it touches. It does not carry a model's contents.

`frameworks` is incidence, not coverage. A framework is listed when at least one
countermeasure maps to at least one of its requirements, so a model addressing a
single control appears identically to one addressing every control. It answers
"which models touch SOC 2 at all", not "which models are SOC 2 compliant".

Returns at most twenty, and cannot reach past the first page. Treat a full page as
"at least twenty" rather than as the whole set.