feat: add role-trusts collection modes

[TacoRocket]

Summary

• make fast the implicit default collection mode for role-trusts
• add explicit full mode for the slower tenant-wide application trust sweep
• align all-checks --section identity with the same default while allowing override via --role-trusts-mode
• surface the selected mode in output, help text, table takeaway, tests, and schema

Validation

• python3 -m ruff check src tests scripts
• PYTHONPATH=src python3 scripts/generate_schemas.py
• PYTHONPATH=src python3 -m pytest tests/test_collectors.py tests/test_cli_smoke.py tests/test_help.py tests/test_terminal_ux.py tests/test_golden_outputs.py
• PYTHONPATH=src python3 -m pytest
• clean-context review: no implementation-vs-plan drift found