Add enterprise SCIM deprovisioning guard

[zergzorg]

@algora-pbc /claim #19

Summary

• Adds a self-contained enterprise SCIM/HRIS deprovisioning guard for issue Enterprise Tooling #19.
• Reconciles HRIS leaver/contract-ended/department-transfer events against SCIBASE roles, SCIM active state, API tokens, export connectors, seat licenses, compute quota, and pending publication ownership.
• Emits clear/review/revoke decisions, admin actions, deterministic audit digests, and JSON/Markdown/SVG/MP4 review artifacts.

Scope boundaries

• Uses synthetic enterprise identity data only.
• Does not call HRIS, SSO, SCIM, payment, KYC, or private account systems.
• Avoids overlap with existing API change governance, connector certification, secret rotation, compute quota governance, AI model governance, funder reporting export, incident response, dashboard attribution, policy exception, IRB consent, initiative tag, and data export approval slices.

Validation

• npm run check
• npm test
• npm run demo
• ffprobe -v error -show_entries format=duration,size -show_entries stream=codec_name,width,height -of default=noprint_wrappers=1 reports/demo.mp4
• git diff --check