[codex] add prod-like Terraform sandbox files

[InfoSecHack]

Summary

• Add Terraform source files for the future prod-like AWS accuracy sandbox without running Terraform.
• Include account/live-ack/resource-prefix guards, AWS provider configuration, IAM-only source/target resource shapes, and the 24-row oracle mapping.
• Add static tests for required files, guardrails, unsupported/static-only rows, no Lambda invocation resources, no public networking, no Organizations/SCP resources, artifact hygiene, and non-claims.

Boundaries

• Terraform source only; no Terraform init/plan/apply/destroy was run.
• No live AWS, AWS CLI, STS/Lambda/API calls, iam:PassRole calls, runner changes, reasoner changes, benchmark semantic changes, release/version change, or new evidence claims.
• No composite benchmark score or pass/fail benchmark label.

Validation

• python -m pytest -q tests/test_prod_like_terraform_sandbox_files.py
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check