Identity P1.3: Identity Center generator — AWS console access from the registries

[gangster]

Part of #884. Strategy §2.6/§5. Replace the hand-maintained mgmt/global/identity-center HCL with a generator.

Scope

• Derive Identity Store users/groups + permission-set account_assignments from gitops/people + gitops/teams + the role catalog (P1.2), via fileset/yamldecode (the pattern keycloak-config already uses).
• [must] projection hardening lands here (§3.3): intent-vs-effected verification (assert the generated native config matches intent) + the decide/apply split (machine-checkable invariants before apply).
• Explicit no-lockout cutover: dual-run → verify-parity → flip; the independent break-glass stays live throughout.

NOT this issue: the per-team cluster (kubectl) access regression #647 — that's a separate plane, resolved by OIDC-native cluster auth (#364). This issue is AWS console/account access only.

Done when: "add a person" → roster PR → applied → they log into the AWS access portal with the right scoped permission set; hand-maintained HCL retired. ⚠️ Live IAM in mgmt — apply from main repo root, AWS_PROFILE=management, plan-check 0 to destroy.

[gangster]

Locked (Q3, see #884): cutover is a provable no-op — seed gitops/people/ + gitops/roles/ to reproduce today's exact Identity Center state, flip the unit to derive, and gate the merge on terragrunt plan = 0 to add / change / destroy. Don't touch the admin/break-glass permission set in the cutover; apply from the main repo root, AWS_PROFILE=management.