feat: RBAC policy-diff CI gate (#719)

[laurentketterle-hub]

Closes #719

• CI check prints added/removed grants per PR
• Blocks merge unless rbac-approved label is set
• Computes diff from serialized policy matrix

Stellar Wave 7th wave

[laurentketterle-hub]

⚠️ CI failures are pre-existing upstream issues

The tsc --noEmit and npm test failures are caused by pre-existing TypeScript errors in the upstream codebase, not by this PR:

src/auth/oidc/oidcAdapterService.ts:339 — consumedJtis property missing
src/auth/refresh/repositoryAdapter.ts — Pool/PoolClient type mismatch (x6)
src/vaults/hardenedMilestoneValidation.ts:408 — catch(error) type narrowing

These errors exist on master without any of our changes. The test and implementation code in this PR follows the existing patterns and conventions.

Happy to help fix the upstream issues in a separate PR if needed.

[laurentketterle-hub]

🚀 @thlpkee20-wq — thanks for merging! Could you confirm the Stellar Wave points attribution on this one? The PR implements the requested feature.