[enterprise-auth S6] Integrate WorkOS Directory Sync and SCIM lifecycle

[rickylabs]

Part of #871

Use WorkOS Directory Sync as the primary normalized SCIM/directory integration
for enterprise tenants. Project users, groups, memberships, and deprovisioning
events into NetScript through the same shared event-sync/webhook consumer used by
EA-06 audit emission and role synchronization. The product promise is
automatic, never “real-time”: provider delivery has latency, retries, and
reconciliation boundaries.

Acceptance

• gate: EA-05 and EA-06 use one provider-neutral event-sync/webhook consumer contract for authenticity, timestamp/replay protection, idempotency, ordering, cursors, retry, and reconciliation
• gate: Directory Sync product/docs language says “automatic” and never promises “real-time” propagation
• gate: directory users, groups, memberships, and organization ownership have stable normalized identifiers
• gate: deprovisioning disables access and revokes or marks affected sessions according to explicit policy
• gate: reconciliation detects missed/out-of-order events without creating duplicate identities
• gate: group-to-role/policy mapping is tenant-scoped and fails closed on unknown or over-limit data
• gate: Better Auth organization/SCIM overlap has a single-writer rule and conflict diagnostics
• gate: lifecycle events are emitted through the enterprise audit envelope

Metadata

• Dependencies: EA-02, EA-12, EA-13; co-owns the shared event seam with EA-06.
• Delivery shape: one shared event-sync consumer plus a WorkOS Directory Sync provider adapter and directory projection storage.