Remove only duplicate product-level controls, keep BSI and others

files/add-almalinux9-support.sh

@@ -84,10 +84,24 @@ if [ -d products/almalinux9/overlays ]; then
         products/almalinux9/overlays/*
 fi
 
-# Upstream CaC ships a maintained controls/cis_almalinux9.yml at the top level.
-# The product-level copy (mechanically renamed from rhel9) would override it and
-# lose AlmaLinux-specific adjustments, so remove it.
-rm -fr products/almalinux9/controls
+if [ -d products/almalinux9/controls ]; then
+    for ctl in $(find products/almalinux9/controls/ -type f -name '*rhel9*'); do
+        mv "$ctl" "$(echo "$ctl" | sed 's/rhel9/almalinux9/g')"
+    done
+    find products/almalinux9/controls -type f -exec sed -i \
+        -e 's/Red Hat Enterprise Linux/AlmaLinux OS/g' \
+        -e 's/RHEL9/ALMALINUX9/g' \
+        -e 's/RHEL-9/ALMALINUX-9/g' \
+        -e '/^id:/s/rhel9/almalinux9/g' \
+        -e '/^product:/s/rhel9/almalinux9/g' \
+        -e 's/ensure_redhat_gpgkey_installed/ensure_almalinux_gpgkey_installed/g' {} \;
+
+    # Remove any product-level control that duplicates a top-level one — the
+    # top-level file contains AlmaLinux-specific adjustments and must win.
+    for ctl in products/almalinux9/controls/*.yml; do
+        [ -f "controls/$(basename "$ctl")" ] && rm -f "$ctl"
+    done
+fi
 
 sed -i \
     -e 's/rhel9/almalinux9/' \