[codex] Add capability honesty matrix

[InfoSecHack]

Summary

• Add a reviewer-facing capability honesty matrix documenting modeled IAMScope coverage, collected/exported but not fully reasoned data, explicit non-coverage, verdict meanings, and interpretation caveats.
• Add drift-prevention tests comparing documented modeled actions against parser RELEVANT_ACTIONS and documented pattern IDs against the shipped CLI reasoner registry.

Boundaries

• Docs/reference and tests only.
• No live AWS, Terraform, reasoner, verdict, benchmark score, or pass/fail label changes.

Validation

• python -m pytest -q tests/test_capability_honesty_matrix.py
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check
• account/ARN hygiene scans
• Terraform/raw artifact scan