feat: tighten identity chain hints

[TacoRocket]

Summary

• add managed-identity and permissions next-review hints using the shared identity handoff vocabulary
• surface operator signal and next review in managed-identities and permissions table output
• update tests and goldens for the new identity chain-hint behavior

Validation

• python3 -m pytest tests/test_collectors.py tests/test_golden_outputs.py tests/test_terminal_ux.py tests/test_models.py tests/test_help.py
• pre-push guardrail suite: 236 passed, 2 deselected
• CCR rerun: no implementation-vs-plan drift found