[codex] Add PassRole Lambda live binding gap checkpoint

[InfoSecHack]

Summary

• add a sanitized checkpoint documenting that the live PassRole-to-Lambda result is not yet bound to a generated IAMScope finding/path
• record the inspected artifact classes and closest non-matching artifacts
• preserve the live-result boundary: observed lambda:CreateFunction success, verified cleanup, redacted account/role, no raw /tmp output committed

Boundary

• docs/checkpoint only
• no live AWS, Terraform, AWS CLI, runner, reasoner, or benchmark changes
• no prediction-vs-observation match claim yet
• no broad IAMScope correctness, broad PassRole correctness, exploitability, downstream authorization, production readiness, composite score, or pass/fail label claims

Validation

• targeted grep for result/boundary/next-slice wording
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check