Add object permission inheritance drift guard

[zergzorg]

/claim #11

Summary

• Adds a self-contained object-permission-inheritance-drift-guard module for User & Project Management issue User & Project Management #11.
• Detects inherited project-role grants that would overexpose restricted datasets, notebooks, manuscripts, or review threads.
• Flags stale object-level allow overrides, missing data-steward approvals, and restricted inherited actions without explicit object override decisions.
• Emits remediation queues, effective grant summaries, deterministic JSON/Markdown/SVG reports, and a short MP4 demo artifact.

Validation

• npm run check
• npm test
• npm run demo
• ffprobe -v error -show_entries format=duration,size -show_entries stream=codec_name,width,height -of default=noprint_wrappers=1 object-permission-inheritance-drift-guard/reports/demo.mp4 -> H.264, 960x540, 5s
• git diff --check
• rg -n "(password|secret|wallet|paypal|bank|passport|tax|kyc|private key|api key|token)" object-permission-inheritance-drift-guard || true -> no matches

Non-overlap

This is a narrow inheritance drift guard between project roles and object-level permission overrides. It avoids the existing broad RBAC/workspace ledger, privacy access review, member lifecycle/offboarding, institutional recertification, anonymous-review escrow, identity merge/export, data-room consent, profile sync, archive handoff, access-audit anomaly, role delegation, invitation-domain/MFA, funding attribution, automation-credential governance, deletion/erasure, break-glass, visibility-transition, and provisioning-baseline slices.

Synthetic data only; no credentials, private identity data, identity-provider calls, payout details, live project data, or private dashboard data are included.