Add prod-like sandbox collect checkpoint

[InfoSecHack]

Summary

• Add sanitized checkpoint for the first controlled prod-like sandbox apply → collect → destroy run.
• Record that Terraform created 39 IAM-only resources, IAMScope emitted scenario/binding/findings artifacts, and Terraform destroyed 39 resources.
• Preserve bounded claims and explicit non-claims.

Evidence recorded

• Apply: 39 added, 0 changed, 0 destroyed
• Collection: scenario.json, binding_metadata.json, findings.json emitted
• Scenario: 44 nodes, 103 edges, 14 constraints, 26 edge constraints
• Findings: 20 total; 3 validated, 5 blocked, 12 inconclusive
• Patterns: 16 passrole_lambda, 4 passrole_ecs
• Cleanup: 39 destroyed; prefix cleanup checks empty for IAM users, IAM roles, and local policies

Boundaries

• Sanitized checkpoint only.
• No raw AWS logs, account IDs, IAM ARNs, Terraform state, lock, plan, output JSON, or result artifacts committed.
• Not IAMScope accuracy, not oracle comparison, not broad correctness, not production readiness, not exploitability proof, no composite score, no pass/fail label.

Validation

• targeted checkpoint grep
• account/ARN hygiene greps
• Terraform/live artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check