[codex] Add PassRole Lambda live binding checkpoint

[InfoSecHack]

Summary

• add a sanitized binding checkpoint comparing the selected local IAMScope passrole_lambda finding to the observed controlled live AWS result
• record the narrow comparison result: matched_for_selected_service_mediated_createfunction_behavior
• preserve redaction and non-claims around Lambda invocation, downstream authorization, admin-equivalent execution role behavior, exploitability, production readiness, and broad correctness

Selected finding

• finding_id: dc284c673334e54974e229c9ac006684b3e928d0d03936f857fe93068dc74dc8
• pattern_id: passrole_lambda
• expected_verdict: validated
• severity: high
• classification: selected_local_createfunction_passrole_finding

Validation

• targeted grep for comparison/result/boundary wording
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check