[codex] add complex replay feasibility probe

[InfoSecHack]

Summary

• Add a local-only complex benchmark replay feasibility probe.
• Report replay-equivalence as not_proven with input-contract gaps for the current frozen synthetic oracle fixture.
• Add focused tests covering output refusal, manifest/summary boundaries, pattern feasibility rows, static-only/unsupported rows, no AWS credential requirement, and no committed generated outputs.

Boundaries

• No fixture semantic changes, reasoner changes, benchmark semantic changes, live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls.
• No replay-equivalence claim, live evidence claim, composite benchmark score, or pass/fail benchmark label.

Validation

• python -m pytest -q tests/test_complex_benchmark_replay_feasibility_probe.py
• python scripts/probe_complex_benchmark_replay_feasibility.py --out /tmp/iamscope-complex-replay-feasibility
• cat /tmp/iamscope-complex-replay-feasibility/replay-feasibility-summary.md
• jq . /tmp/iamscope-complex-replay-feasibility/replay-feasibility-manifest.json
• grep account/ARN hygiene scans
• find generated live/Terraform artifacts scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check