[0.5.0][Stretch] OIDC claim to role/principal mapping

[erichare]

Stretch goal (pull in if the quarter allows) — highest leverage for the RLAC flagship.

Goal

Make RLAC usable without manual principal setup by mapping identity claims to roles/principals.

Scope

• Map OIDC groups/claims → workspace roles + RLAC principals; reserved groups attribute on ResolvedPrincipal. Optional SCIM provisioning.

Key files

runtimes/typescript/src/auth/oidc/*, runtimes/typescript/src/auth/principal-resolver.ts

Depends on: RLAC P2