Shared people once per provider, -Tier on AD and Okta, and a step table for New-ADEnvironment

[fadwen]

Three smaller things, each its own commit.

Every shared person exists once in every provider

The Active Directory data logs the eleven people written in other writing systems in under logins of its own (josen for jnino, zoem for zmueller), and the four seed generators mapped those rows across as bulk people beside the core rows that already carried them. Entra, Authentik, FreeIPA and PingOne each held the same eleven people twice under two logins.

The generators now recognise a shared person by name, skip the AD row, and remember it under the shared key so a bulk person managed by one of them still points at them. Each bulk tier is 300 people rather than 311: 318 Entra users, 319 Authentik and PingOne users, 346 FreeIPA users. The counts in the tests, the READMEs and the help follow. The AD data keeps its own logins, which is why Compare-TestEnvironment matches it by name.

-Tier means the same thing on every provider

Entra, Authentik, FreeIPA and PingOne already took -Tier Core for the designed people and -Tier Bulk for the generated volume; AD and Okta took nothing, so a script written for one provider failed on the other two.

• ADUsers.csv carries a Tier column: Core for the eleven people every provider holds, Bulk for the three hundred generated. New-ADTestUser and New-ADEnvironment take -Tier. A manager left out by the tier is not set rather than looked for and reported missing.
• OktaUsers.csv carries the column too, every row Core, because eight designed people leave no room for volume. New-OktaUser and New-OktaEnvironment accept -Tier so the same call runs everywhere.
• New-ADTestUser creates its users on background jobs, which a unit test cannot stand in for, so the row selection and the manager pairs now come from Select-ADTestSeedUser, tested against the real data. The command is held to asking the helper for the tier it was given before any job starts.

New-ADEnvironment runs its steps from a table

The eight steps were eight copies of the same forty lines. They are now declared as data in dependency order, the way the Entra and Okta orchestrators declare theirs, and one loop announces, gates, runs and records each of them. Nothing observable changed: the same ShouldProcess targets, the same step results under Operations, the password policy and DNS steps still judged on the errors they collect, the deny-logon policy still right after the service accounts and only when they succeeded, and the vault or the password file still written for the service accounts. One message did: a step not attempted because the domain controller stopped answering now says so, where it used to say "skipped as requested". Three tests were added for the vault path, the file fallback and that message.

Checks

• Invoke-Pester ./Tests/Unit: 2,731 passed on PowerShell 7 (one skipped, pre-existing) and 2,732 passed on Windows PowerShell 5.1, none failed. The 5.1 run caught a Sort-Object -Stable that 7 accepts; it is gone.
• Invoke-ScriptAnalyzer -Recurse -Severity Error, Warning: clean.
• ./Build/Build-Help.ps1: rebuilt; Publish-Module.ps1 -WhatIf: passes, Verify/ not shipped.
• Live: a full Active Directory cycle on the lab domain controller through the rebuilt orchestrator, seed to verify to teardown.