docs(adr): ADR-0134 mirrors the open half of cloud ADR-0071 — env-side SCIM, with the ban written by this platform (#16476)

Mirrors the mechanism half of `cloud ADR-0071` (Enterprise Identity — SCIM v1,
2026-06-27) into this repo under the maintainer's 2026-09-02 ruling on #14496:
D1 (adopt @better-auth/scim), D2 (the Service Provider lives in the env),
D3 (single-organization; active:false disables, DELETE never erases), D4 (default
standing only, group->role a declared seam) and the open half of D7 (CI coverage).

D5, D6 and the real-IdP E2E stay in cloud and are cited as `cloud ADR-0071`.

The record states, and this branch re-measured, the vendor-version fact: at the
pinned @better-auth/scim 1.7.2 the substring `ban` occurs zero times in the
package (1.6.30: 14, incl. resolveSCIMActiveDeactivation; removed in 1.7.0), so
the disable is written by this platform's identity.reconcileUser hook and judged
at the engine by the break-glass last-administrator guard.


Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-warren