ISO 27001 penetration testing: which clauses and Annex A controls it supports, what the auditor wants, and why continuous keeps your ISMS current.