[codex] Add denied PassRole Lambda live validation design

[InfoSecHack]

Summary

• add a docs-only design for one denied controlled PassRole-to-Lambda live validation case
• select the denied condition: source can call Lambda CreateFunction but lacks iam:PassRole to the selected execution role
• document expected live access_denied, function_created=false, cleanup_status=not_needed, and current local IAMScope no-selected-finding expectation

Boundaries

• docs/design only
• no live AWS, Terraform, AWS CLI, STS, Lambda API, or iam:PassRole calls
• no runner, reasoner, benchmark semantic, or public claim changes

Validation

• targeted grep for denied/live/local-expectation wording
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check