[codex] add PassRole Lambda replay subset probe

[InfoSecHack]

Summary

• Add a tiny replay-ready PassRole-to-Lambda subset fixture for the complex synthetic benchmark theme.
• Add a local-only probe that runs existing IAMScope replay machinery against the subset when input-contract checks pass.
• Add focused tests covering fixture hygiene, repo-output refusal, replay status, matched/static-only rows, local-only boundaries, and no committed generated outputs.

Result

• replay_subset_status: replayed_selected_passrole_lambda_subset
• input_contract_status: replay_ready
• matched_rows: 1
• missing_rows: 0
• static_only_rows: 1

Boundaries

• PassRole-to-Lambda subset only; no full complex benchmark replay-equivalence claim.
• No fixture semantic changes to the existing complex benchmark, reasoner changes, benchmark semantic changes, live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls.
• No composite benchmark score or pass/fail benchmark label.

Validation

• python -m pytest -q tests/test_complex_passrole_lambda_replay_subset.py
• python scripts/probe_complex_passrole_lambda_replay_subset.py --out /tmp/iamscope-complex-passrole-lambda-replay-subset
• cat /tmp/iamscope-complex-passrole-lambda-replay-subset/replay-subset-summary.md
• jq . /tmp/iamscope-complex-passrole-lambda-replay-subset/replay-subset-manifest.json
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check