Compare-TestEnvironment: match the people two connected providers hold

[fadwen]

Follows #44, now merged.

What

Compare-TestEnvironment -Provider A, B reads the seeded people from two providers connected in the same session and reports how they line up, the way a hybrid identity match would see them.

• Matching. By login key first: the login with the provider's additions stripped, so jnino is jnino in every provider that keeps the shared logins (ZZ-TEST-jnino@… on Entra, zz-test-jnino on PingOne, jnino@… on Okta). Then by display name among what is left, folded for case and Unicode normalisation, because the Active Directory data logs its people in as first name and initial and agrees with the others only on the names. What matches in neither way is reported as only on one side, and that is not a fault: the providers hold deliberately different populations.
• Judging. For every matched pair the names are compared by codepoint, never with -eq: display names where both providers keep one, otherwise given name and surname where both keep those, never a stored display name against one composed from parts (PingOne stores no display name, and a composed one would put the family name last for the Han and Japanese people). A decomposed José in one directory and a precomposed one in the other is found by the folded match and reported as differing. That is the one thing the command judges. The enabled state is compared and reported without a verdict, because the seed hangs different states on the same person on purpose.
• Shape. Get-<Provider>IdentitySnapshot on each provider reduces the users teardown would find to a TestIdentity (Core/New-TestIdentity.ps1); Core/Compare-TestIdentitySnapshot.ps1 does the matching and judging on identities alone, so it is tested without a directory. A contract test holds every provider folder on disk to having a snapshot reader. Get-EntraSeededObject now also selects givenName and surname, so a tenant compares with a PingOne environment on the parts.

Live

PingOne and Entra seeded and compared both ways from one session: 329 matched by key, none by name, the one PingOne-only account named (pmorel), no name differing, then both torn down clean (the three Entra role definitions kept by design, as before). See the changelog for the parts-compared numbers from the rerun after the rule was widened.

Gates

Unit suite 2,700 passed shuffled on 7 (1 skipped) and 2,701 on 5.1, 0 failed, before the parts rule; the targeted suites and the contract suite after it. Analyzer clean. MAML rebuilt. Rehearsal passes. Docs page, index, README, about topic, CHANGELOG, Tests/README and a CLAUDE.md paragraph.