* feat(infra): add kebab WO tables and PLAT-11 cutover tooling
Create empty work-orders/work-order-comments under Terraform while writers
stay on PascalCase; make emitter table classification env-driven and add
same-account migrate/verify plus cutover runbook.
* style(test): ruff-format shoc emitter envelope tests
* iac(access): temporary shoc-assessment-dynamo-reader role for Luby initial assessment
30-day, read-only (GetItem/Query/Scan/DescribeTable) cross-account role in
seahaven-prod trusting seahaven-external-dev, trust-policy hard expiry
2026-08-23. Steady state remains procurement-api + webhook; teardown script
included.
* harden(access): resolve sh-security-review findings on assessment reader
C1 (confirmed medium): DateLessThan expiry condition duplicated into both
permissions statements so in-flight sessions die at the deadline, not +1h.
C2 (confirmed medium): teardown now strips ALL inline/attached policies and
instance profiles before DeleteRole (kill-switch semantics restored,
idempotent), emergency-revocation section added to README.
Cheap hardenings: CDPATH-immune SCRIPT_DIR, MaxSessionDuration re-asserted
on update path, data-handling expectations documented.
* harden(access): address Open SWE review on #141
- Trust now requires ArnLike aws:PrincipalArn on the Identity Center role
path (human SSO sessions only; string condition survives permission-set
reprovisioning, unlike a role-ARN Principal pin)
- README extend instructions cover BOTH expiry sites (trust + permissions)
- Create script logs caller ARN + timestamp and validates the policy's KMS
ARN against SSM /seahaven/dynamodb/cmk-arn before applying
