[codex] add prod-like Terraform sandbox design

[InfoSecHack]

Summary

• Add the Phase 3 Terraform sandbox design for the prod-like AWS accuracy benchmark.
• Map the frozen 24-row oracle fixture to future Terraform resource groups without expanding scope.
• Define dedicated sandbox account policy, future module layout, max v1 limits, optional live probe categories, collection/cleanup plans, gates, and non-claims.

Boundaries

• Docs/spec only.
• No Terraform files, tests, code, runner changes, live AWS, AWS CLI, STS/Lambda/API calls, iam:PassRole calls, Terraform init/plan/apply/destroy, reasoner changes, benchmark semantic changes, release/version change, or new evidence claims.
• No composite benchmark score or pass/fail benchmark label.

Validation

• design grep for fixture id, Terraform path, dedicated sandbox/account guard/ack, max v1 limits, live probe boundary, gates, non-claims, and next slice
• account/ARN hygiene scans
• generated live/Terraform artifact scan
• ./scripts/check.sh
• ./scripts/test_fast.sh
• git diff --check