[codex] Add sanitized PassRole Lambda live result checkpoint

[InfoSecHack]

Summary

• add a sanitized checkpoint for the controlled PassRole-to-Lambda live validation result
• record the observed lambda:CreateFunction success and verified cleanup without committing raw /tmp result JSON
• keep account id, role ARN, Terraform outputs/state, and raw live artifacts out of the repository

Boundaries

• docs/checkpoint only
• no live AWS, Terraform, AWS CLI, runner, reasoner, or benchmark changes in this PR
• no production readiness, broad IAMScope correctness, broad PassRole correctness, exploitability, or downstream authorization claims

Validation

• grep -nEi 'create_function_succeeded|deleted_not_found_verified|function was not invoked|not broad IAMScope correctness|not exploitability|Recommended next slice|account.*redacted|role.*redacted' docs/specs/controlled-passrole-lambda-live-result-001-checkpoint.md
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check