[codex] Fix SCP binder source account scope

[InfoSecHack]

Summary

• Fix bind_all_scps to scope SCPs by the edge source/principal account instead of the destination/resource account.
• Preserve target/resource matching inside bind_scp_to_edge.
• Add focused cross-account, same-account, resource-pattern, PrincipalArn applicability, source-unavailable, and OU-map regression tests.

Root cause

SCP scope filtering used edge.dst to extract the account for OU/account matching. SCPs govern principals, so cross-account edges could miss source-account SCPs or incorrectly apply target-account SCPs.

Validation

• python -m pytest -q tests/test_scp_binder.py: 43 passed
• ./scripts/check.sh: passed
• ./scripts/test_fast.sh: 1959 passed
• git diff --check: passed
• Account/ARN scans: only pre-existing placeholder examples remain in source comments/help
• Artifact scan: no matches