[codex] add Phase 4 live approval runbook

[InfoSecHack]

Summary

• Add the Phase 4 live-approval runbook for the prod-like AWS accuracy sandbox.
• Define approval gates, future-only Terraform command sequence, plan review checklist, optional live probe categories, sanitization rules, cleanup proof, Phase 5 handoff, stop conditions, and non-claims.
• Keep all commands as examples only and mark them DO NOT RUN UNTIL PHASE 4 APPROVAL.

Boundaries

• Docs/runbook only.
• No Terraform changes, tests, code, runner changes, Terraform init/plan/apply/destroy, live AWS, AWS CLI, STS/Lambda/API calls, iam:PassRole calls, reasoner changes, benchmark semantic changes, release/version change, or new evidence claims.
• No composite benchmark score or pass/fail benchmark label.

Validation

• runbook grep for Phase 4 boundary, future Terraform command examples, account guard, max probes, cleanup proof, Phase 5 handoff, non-claims, and next slice
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check