[codex] Add identity recovery risk guard

[newmattock]

Addresses #11

Summary

• add identity-recovery-risk-guard, a focused user/project management slice for issue User & Project Management #11
• evaluate MFA resets, SAML rebinds, password resets, project-access holds, session revocations, and reviewer evidence packets before restoring sensitive project access
• include sample recovery cases, requirement map, SVG/MP4/GIF demo artifacts, and local validation scripts

Validation

Fresh validation on 2026-05-17 21:06 PDT:

• npm run check
• npm test -> Node test runner passed 4 tests, 0 failures
• npm run demo -> digest e05ebc62fab58e7c, 3 requests reviewed, 1 critical request, 1 high request, 3 project holds, 2 session revocations, and 3 missing evidence items
• npm run demo:gif -> wrote docs/demo.gif
• file docs/demo.gif docs/demo.mp4 docs/demo.svg -> GIF image data, MP4 v2, and SVG
• git diff --check
• focused sensitive-string scan for API keys, secrets, tokens, private keys, wallet material, and EVM addresses; the only matches were reviewed domain terms for password-reset behavior, not credential material

/claim #11

[newmattock]

@algora-pbc /claim #11