[codex] wire replay subset into public demo review

[InfoSecHack]

Summary

• Wire the narrow PassRole-to-Lambda replay subset probe into the one-command public demo review runner.
• Add a separate summary and manifest layer for passrole_lambda_replay_subset with matched/missing/extra/static-only counts.
• Update the public demo review runbook and focused runner tests.

Result

• replay_subset_status: replayed_selected_passrole_lambda_subset
• input_contract_status: replay_ready
• safe_replay_attempted: true
• reasoners_attempted: passrole_lambda
• matched_rows: 1
• missing_rows: 0
• extra_rows: 0
• static_only_rows: 1

Boundaries

• Local-only runner integration; no live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls.
• No full complex benchmark replay-equivalence claim.
• No composite benchmark score or pass/fail benchmark label.

Validation

• python -m pytest -q tests/test_public_demo_review_runner.py tests/test_complex_passrole_lambda_replay_subset.py
• python scripts/run_public_demo_review.py --out /tmp/iamscope-public-demo-review
• cat /tmp/iamscope-public-demo-review/summary.md
• jq .passrole_lambda_replay_subset /tmp/iamscope-public-demo-review/manifest.json
• summary grep for replay subset boundaries and non-score language
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check