Similar Items: A Modular Privacy Engineering Framework for Regulatory-Compliant System Design: Capability Composition, Evidence Traceability, and Practitioner-Oriented Evaluation