[yongjip]

Closes #11

Summary

• discover IAM_Allowed_Principals coverage for explicitly desired databases and tables during live inventory
• keep coverage in the existing Grant model and emit stable IAM_ALLOWED_PRINCIPALS_PRESENT audit evidence
• expose compatibility coverage as non-decisive explain context without changing access decisions
• prevent compatibility-principal grants from producing revoke plans
• document review interpretation, catalog scope, ignore behavior, and advisory boundaries

Decision contract

• recommended_action: review_required
• hard_block: false
• no AWS writes, conversion helper, account-wide discovery, or approval orchestration

Verification

• PYTHONPATH=src /tmp/lfpolicy-issue-test/bin/python -m unittest discover -s tests
• 340 tests passed; 3 optional Moto tests skipped
• PYTHONPATH=src /tmp/lfpolicy-issue-test/bin/python -m lfpolicy review --desired examples/desired.json --current-snapshot examples/current-snapshot.json --output-dir /tmp/lfpolicy-review-smoke --force