Improve IAM downstream deprovisioning evidence gates

[danyili2632]

Summary

• adds downstream deprovisioning findings for residual sessions, refresh/API/mobile tokens, app-local role propagation, and machine-identity owner lifecycle gaps
• adds evidence gates that distinguish SCIM/IdP status from relying-party access state
• requires token/session revocation, app-local RBAC/cache checks, non-SCIM compensating controls, and Not Evaluable handling
• extends the report output with a downstream deprovisioning evidence table
• adds OAuth/SCIM revocation reference guidance for RFC 7009, RFC 7644, and NIST SP 800-207

Validation

• git diff --check
• rg -n "IAM-STALE-09|Downstream Deprovisioning|Session and token revocation|Machine identity impact|Not Evaluable|RFC 7009|RFC 7644|SCIM|OAuth refresh" skills/identity/iam-review/SKILL.md
• verified Markdown fence count remains even: 20

Closes #1441

Bounty target: Improver Moderate if accepted.
Preferred payout: Base USDC 0x6CBF4b5cb88b8C2B7af776Bc2B073163B5d3C08A