fix: token cache key, policy simulator creds, s3 rm guardrail, sync-aws-config

[DustyStudy]

Summary

Fixes four correctness bugs found in a review of the repo. Each fix is its own commit and comes with regression tests.

1. SSO token cache never hit. The cache key used the builtin hash(), which is randomized per process, so every command re-ran the browser login (and creds-process did on every aws call) and orphaned token entries piled up. The key is now a truncated SHA-256 of the start URL.
2. check-policy / --check-action used the wrong credentials. simulate() built its IAM client from ambient credentials instead of the role's. It now takes the role credentials explicitly. Also removes a reference to a --role-arn flag that doesn't exist.
3. Built-in recursive s3 rm guardrail never matched. The pattern required --recursive before s3. It is now aws*s3 rm*--recursive*. The built-in ec2 terminate-instances pattern could not match any real command and is removed (users can still deny it in guardrails.yaml).
4. sync-aws-config bugs.
   • --prefix collapsed every account into one profile. Profiles are now <prefix>-<alias>[-<role>], and two entries mapping to the same name raise an error.
   • The file was round-tripped through configparser, deleting comments and reflowing everything. It is now edited as text, so only orgctl-managed sections change and everything else is preserved byte-for-byte, including line endings.
   • The single .bak was overwritten on every run, so the original was lost after two syncs. Backups are now timestamped and never overwritten, and a run that changes nothing writes nothing.

README and docs/THREAT_MODEL.md are updated to match.

Behavior changes

• --prefix with --all-roles now yields <prefix>-<alias>-<role> (previously <prefix>-<role>, which collided across accounts).
• aws_config_sync.sync() returns a SyncResult (a named tuple that now includes the backup path). Callers unpacking four values need updating; only cli.py and the tests call it.
• Backup files are ~/.aws/config.bak-<timestamp> instead of a single ~/.aws/config.bak.
• orgctl still does not delete profiles it wrote earlier, so changing --prefix / --all-roles leaves the old ones behind (documented in the README).

Verification

• ruff check, ruff format --check, mypy src: clean.
• pytest: 80 passed (was 49); coverage 43% to 51%.
• The new tests for 1-3 fail against the old code and pass with the fixes.
• Ran orgctl sync-aws-config end to end against a scratch ~/.aws/config containing comments: comments survived, --prefix produced one profile per account, an identical re-run made no backup, and each change made a new backup with the original intact.

Not in this PR

Still open from the review: other built-in deny patterns also require aws immediately followed by the service (so aws --profile x s3 rb ... --force slips through), CloudWatch push timestamps, uncaught ClientError on a revoked token, and the CLI test coverage gap.