Upstream CaC ships a maintained controls/cis_almalinux9.yml with
AlmaLinux-specific adjustments (correct source URL, SSH crypto policy
marked not applicable, almalinux NTP variable, etc.). The product-level
copy mechanically renamed from rhel9 is loaded after the top-level file
and silently overrides it, losing all those adjustments.
Drop products/almalinux9/controls/ entirely so the correct top-level
file is used.