[codex] add local prod-like oracle fixture design

[InfoSecHack]

Summary

• Add the Phase 2 local prod-like oracle fixture design for the prod-like AWS accuracy benchmark roadmap.
• Freeze fixture identity, future path, target shape, oracle categories, a 24-row row plan, future files/tests, comparison method, gates, and non-claims.
• Set the next slice to implement local prod-like oracle fixture files and oracle tests.

Boundaries

• Docs/spec only.
• No fixture JSON, tests, code, runner changes, Terraform, live AWS, AWS CLI, STS/Lambda/API calls, iam:PassRole calls, reasoner changes, benchmark semantic changes, release/version change, or new evidence claims.
• No composite benchmark score or pass/fail benchmark label.

Validation

• design grep for fixture id/path, 24 rows, category breakdown, required row IDs, live-AWS gate, non-claims, and next slice
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check