[codex] design complex synthetic benchmark fixture

[InfoSecHack]

Summary

• Add a docs-only design for complex_shared_uncertainty_iam_benchmark_001.
• Define the future synthetic graph shape, verdict categories, shared uncertainty classes, fixture files, tests, and runner integration plan.
• Preserve local-only, bounded-evidence, non-score, non-pass/fail framing.

Boundaries

• Design/spec only, no fixture JSON, tests, runner changes, reasoner changes, benchmark semantic changes, live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls.
• No new live evidence claims, broad correctness claims, exploitability claims, composite benchmark score, or pass/fail benchmark label.

Validation

• grep -nEi 'complex_shared_uncertainty_iam_benchmark_001|validated|blocked|precondition-only|inconclusive|shared_passrole_target_resource_scope_unknown|shared_cross_account_trust_condition_unknown|shared_boundary_or_session_policy_context_missing|Recommended next slice|not broad IAMScope correctness|not exploitability|no composite benchmark score|no pass/fail benchmark label' docs/specs/complex-synthetic-benchmark-design.md
• grep -RInE '[0-9]{12}' docs tests | grep -v '000000000000' || true
• grep -RInE 'arn:aws:iam::[0-9]{12}' docs tests | grep -v '000000000000' || true
• ind . -name 'result.json' -o -name 'terraform.tfstate*' -o -name '.terraform.lock.hcl' -o -name '*.tfplan' -o -name 'terraform-outputs.json'
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check