feat: implement T19, T20 — Scenario B/C replacement tests; complete workplan

- T19: Scenario B tests — IAM swap correctness (7 tests: profile safety, client mapping, user/group preservation)
- T20: Scenario C tests — full expansion correctness (6 tests: LDIF round-trip, target differences, MFA orthogonality)
- CI scripts: test-scenario-b.sh, test-scenario-c.sh
- README: complete documentation with quick start, endpoints, migration guide
- Workplan: all acceptance criteria checked off

All 23 tasks done. 15 test packages, all green. go vet clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/ralph-loop.local.md

@@ -1,33 +0,0 @@
----
-active: true
-iteration: 1
-session_id: 
-max_iterations: 30
-completion_promise: "HEUREKA"
-started_at: "2026-03-13T00:07:01Z"
----
-
-Do a high quality implementation of workplan KEY-WP-0001-keycape-implementation.md as follows:
-
-Requirements and Boundaries
-- Keep the scope of the workplan
-- Use documents in spec/ and wiki/ folder to understand the big picture
-- Document important architecture decisions as ADRs in the architecture/ folder
-- Save relevant parts of documentation you need to grab online to the research/ folder
-- Keep the state-hub up to date with task completions
-- If stuck and when running out of iterations document what went wrong in problems/ folder
-
-WHILE TDD-Loop for all tasks:
-1) RED: write test → run → fail
-2) GREEN:  implement minimal code → run → pass
-3) REFACTOR: refactor → run → pass
-REPEAT
-
-Success Criteria:
-- No linter errors
-- All tasks and requirements of workplan implemented
-- Documentation updated showing how the application works
-- Check Workstream DoD from the state-hub policies
-
-Refine until all succes-criteria have been met, otherwise 
-output <promise>HEUREKA</promise> when done!