[codex] add complex synthetic benchmark fixture

[InfoSecHack]

Summary

• Add the local-only frozen synthetic oracle fixture complex_shared_uncertainty_iam_benchmark_001.
• Pin 42 naive candidates, 18 findings, verdict breakdown 4/5/3/6, and uncertainty group counts 3/2/1.
• Add focused oracle tests for fixture shape, synthetic-only IDs/ARNs, metadata, non-claims, pattern coverage, and artifact hygiene.

Boundaries

• Fixture/test slice only, no runner integration yet.
• No live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls.
• No reasoner changes, benchmark semantic changes, live evidence claims, composite benchmark score, or pass/fail benchmark label.
• indings.json is explicitly static_fixture_authoring and rozen_synthetic_oracle, not generated/replayed by IAMScope.

Validation

• python -m pytest -q tests/test_complex_synthetic_benchmark_fixture.py
• grep -RInE '[0-9]{12}' docs tests | grep -v '000000000000' || true
• grep -RInE 'arn:aws:iam::[0-9]{12}' docs tests | grep -v '000000000000' || true
• ind . -name 'result.json' -o -name 'terraform.tfstate*' -o -name '.terraform.lock.hcl' -o -name '*.tfplan' -o -name 'terraform-outputs.json'
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check