Add prod-like sandbox v3 collect compare checkpoint

[InfoSecHack]

Summary

• Add a sanitized v3/current-main prod-like sandbox collect-and-compare checkpoint.
• Record Terraform lifecycle, v3 IAMScope collection shape, findings/verdict/pattern counts, comparator summary, cleanup verification, and artifact hygiene.
• Preserve explicit non-claims: no broad IAMScope correctness, no production readiness, no full oracle success, no exploitability/downstream/Lambda invocation proof, no v2/v3 ID compatibility claim, no composite/pass-fail benchmark label.

Validation

• targeted checkpoint fact/non-claim grep: passed
• account/ARN hygiene scans: clean
• Terraform/raw artifact scan: clean
• ./scripts/check.sh: passed
• ./scripts/test_fast.sh: 1996 passed
• git diff --check: passed