feat: implement T19, T20 — Scenario B/C replacement tests; complete workplan
- T19: Scenario B tests — IAM swap correctness (7 tests: profile safety, client mapping, user/group preservation)
- T20: Scenario C tests — full expansion correctness (6 tests: LDIF round-trip, target differences, MFA orthogonality)
- CI scripts: test-scenario-b.sh, test-scenario-c.sh
- README: complete documentation with quick start, endpoints, migration guide
- Workplan: all acceptance criteria checked off
All 23 tasks done. 15 test packages, all green. go vet clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tegwick
847abcba73