feat(cp): IdentityMismatch reconcile check (ADR #19 slice 3)

[brettchien]

Drafted by Orca (ecs-claude) — flagging authorship (shared GitHub identity).

Third slice of ADR #19 — the reconcile step that closes the declare → switch → observe → reconcile loop. Stacked on #21 (slice-2); base will retarget to main when #21 merges.

What:

• studio-cp — principal_matches(expected, actual): the read-only IdentityMismatch check. A warning signal, never an authz gate (ADR-2 authz stays deferred). Handles the STS assumed-role vs IAM role shape (expected …:role/R matches actual …:assumed-role/R/SESSION) and a trailing * wildcard. A static user/… never satisfies a role expectation — exactly the fallback we want flagged. Unit-tested, including the incident case (role expected, user/brett.chien resolved → mismatch) and wrong-account.
• oab-mcp — runtime_context now reports expected_principal and identity_matches (null when the binding declares no expectation).

Effect: with a binding's expected_principal set, runtime_context flags on sight when the resolved identity isn't the intended one — today's deploy_list incident would have tripped it (identity_matches: false).

Scope: reconcile is observe-only — it reports, it does not block. Enforcement is out of scope by design (ADR-2). Assume-role credential form is the next slice (its AssumeRoleProvider API is version-sensitive and there's no existing pattern in-repo to mirror, so I'm landing it isolated to keep CI churn off this one).

Verification: CI on this PR; new unit test covers the matcher. Local full builds OOM on aws-sdk-ec2 per the ci.yml note.

Relates to #19, stacks on #21.

🤖 Generated with Claude Code