[codex] add prod-like Terraform IAM relationships

[InfoSecHack]

Summary

• add IAM-only source inline policies, policy attachments, permission-boundary assignments, guardrail simulation attachments, and explicit deny attachment to the prod-like accuracy sandbox Terraform source
• preserve unsupported oracle rows as static-only/no-live-resource mappings
• add focused static tests for IAM relationship resources, forbidden AWS resource/resource-secret classes, row coverage, non-claims, and artifact hygiene

Boundaries

• no Terraform commands run
• no live AWS
• no AWS CLI, STS, Lambda, or iam:PassRole calls
• no runner/reasoner/benchmark semantic changes
• no composite score or pass/fail benchmark label

Validation

• python -m pytest -q tests/test_prod_like_terraform_sandbox_files.py: 15 passed
• account/ARN hygiene greps: clean
• Terraform/live artifact find scan: clean
• ./scripts/check.sh: passed
• ./scripts/test_fast.sh: 1923 passed
• git diff --check: passed