Prepare scoped Quick Launch IAM administrator

[santisiri]

Summary

• add a deterministic one-hour PoHQuickLaunchIamAdministrator permission-set and assignment renderer
• correct tagged role creation by authorizing iam:TagRole only beside iam:CreateRole on the exact PoHQuickLaunchImagePublisherRole ARN
• require exactly network=base-sepolia, purpose=image-publisher, and release=poh-quick-launch-v1 request tags; missing, altered, or extra tags fail closed
• retain the exact-resource boundary and exclude iam:UntagRole, unrelated roles, secret access, ECR publication, and application deployment
• supersede the incomplete live policy/package hashes and regenerate deterministic policy, request-plan, and fixture package-binding hashes

Safety

• repository-only correction; no AWS API call or mutation was performed
• no role-creation retry, credentials, secrets, ECR token, image push, application deployment, funding, mainnet work, or external blockchain transaction
• the old live package binding is revoked; a fresh protected read-only render is required after merge before any separately approved AWS write

Validation

• frozen install, remote-font rejection, workspace builds and typechecks passed
• SDK, status-operator, Proof of Humanity product/cross-stack, V2 vault/refresh, and corrected IAM failure-path suites passed
• Chromium holder hardening passed 4 tests; Quick Launch PWA passed 1 test
• Rust fmt, clippy, locked build, serial workspace tests, and multi-node m5_stage_a passed
• V2 Rust/WASM, content hashes, byte parity, deterministic artifact reproduction, and ignored Groth16 proof generation passed
• Forge format/build and 202 tests passed; target coverage passed at 100 percent lines and branches; 12 gas snapshots passed offline
• disposable local-Anvil CI tooling rehearsal passed on chain 31337 only
• git diff --check passed

The first sandboxed Rust attempt could not bind localhost and the first online Foundry coverage attempt hit the known macOS SCDynamicStore panic; the identical gates passed with local-listener permission and the established offline Foundry mode.