[codex] Add real-pilot human review summary

[InfoSecHack]

Summary

• Add a sanitized human-review summary for the first real dev-account IAMScope pilot.
• Record bounded collection/finding/reviewer-label counts without committing raw AWS artifacts, account IDs, IAM/STS ARNs, scenario JSON, findings JSON, labels, or review outputs.
• Document preliminary interpretation, calibration candidates, next validation steps, and explicit non-claims.

Boundaries

• Docs-only case-study summary.
• No live AWS, Terraform, code, tests, reasoner, benchmark, score, or pass/fail label changes.

Validation

• targeted grep for key counts, collection_context caveat, AdministratorAccess calibration candidate, and non-claims
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check
• account/ARN hygiene scans
• Terraform/raw artifact scan