Census the position-name fold and generate the implicit-grant audit report (#13419 slice 1) (#13643)

* feat(scripts): census the position-name fold and generate the implicit-grant audit report

#13419 执行要点 1 + 4. Measurement only: no resolution behaviour changes, and
the fold at `requested = [...positions, ...explicitPermissionSets]` is read,
never edited (要点 2/3 depend on this census and their landing file is held).

The census classifies every declared position name against every declared
permission-set name and the junction rows this repo creates, so a collision
with no junction row is reported as a name-fold dependency. `--audit` turns a
deployment export into the per-organization implicit-grant report, and refuses
to read an empty export as "zero implicit grants".

Controls run before any number is printed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

* fix(scripts): spell the census key separator, not the raw NUL byte

`check:nul-bytes` caught 4 raw 0x00 bytes in the census's own key joins — the
editor materialised them where a separator was intended, which is the exact
hazard that gate exists for. Replaced with `::`, which cannot occur in a
snake_case position or permission-set name.

Behaviour-neutral: census and audit output are byte-identical before and after.

Also notes, for whoever lands 要点 2, that the `sales_manager` positive control
pins today's state and goes red — correctly — once its junction row exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

* fix(scripts): anchor the binder scan on the tuple TYPE, not one app's constant name

The binder scan keyed on the identifier `POSITION_PERMISSION_SET_BINDINGS`,
which is what app-showcase happens to call its list. app-crm calls the identical
structure `BINDINGS`, so three real junction rows (sales_rep / sales_manager /
finance_approver -> crm_sales_user) were invisible and `finance_approver` was
reported INERT while it is in fact bound.

Under-collection on the junction side is how a census hands 要点 2 a worklist
that deletes a live grant, so it is now pinned by a second-binder control on a
DIFFERENT app. Anchored on the labelled tuple `[position: string,
permissionSet: string]`, which a binder cannot drop without giving up the type.

Junction bindings 10 -> 13, inert positions 8 -> 7. Name-folds stay 2: the fold
is about the pair (position N, set N), and `sales_manager` being bound to
`crm_sales_user` does not retire its fold onto the same-named HotCRM set —
now asserted, so the distinction 要点 2 turns on cannot be lost silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-steve