refactor(terraform): isolate identity-center assignments per env

[JackMaarek]

• split identity-center module into bootstrap (dev) and assignment (staging/prod)
• shared/dev: create permission sets + groups + dev assignments only
• shared/staging: add staging assignments via remote state from dev
• shared/prod: add prod assignments via remote state from dev
• remove cross-env account_id variables from each env's tfvars and variables.tf
• delete old identity-center module

What

Why

Changes

• path/to/file — reason

Checklist

• Branch is based on latest main (git log --oneline main..HEAD)
• No env-specific values on main-bound files

  grep -r "env: dev\|eu-west-3\|k8s-platform-dev\|esoIrsaRoleArn: \"\"" argocd/ kubernetes/helm/

• No unreplaced placeholder in manifests (only allowed in ApplicationSet elements:)

  grep -r "__ENV__\|__CLUSTER_NAME__" kubernetes/manifests/ kubernetes/helm/

• Commit messages follow Conventional Commits (type(scope): description)
• No file exceeds 200 lines (find . -name "*.yaml" -o -name "*.go" | xargs wc -l | sort -rn | head -20)
• No secrets or credentials committed (git diff main --name-only | xargs grep -l "password\|secret\|token\|key" 2>/dev/null)
• ArgoCD wave order documented in comments if sync order matters
• SRP respected — one file, one responsibility

Testing

• kubectl apply --dry-run=server on changed manifests
• ArgoCD sync validated on local cluster (Kind)
• No new CrashLoopBackOff or ImagePullBackOff after sync

Notes for reviewer