Add project role delegation guard

[tuanadr]

/claim #11

Summary

• Adds a self-contained project role delegation approval guard for sensitive user/project workflows.
• Checks sponsor approval, MFA/SAML/ORCID posture, separation of duties, action-specific delegated scopes, and expiry windows.
• Emits deterministic approval packets, reviewer checklist, JSON/SVG/Markdown output, and a short MP4 demo.

Demo artifacts

• project-role-delegation-guard/demo-output/delegation-review-packet.json
• project-role-delegation-guard/demo-output/approval-checklist.md
• project-role-delegation-guard/demo-output/demo.svg
• project-role-delegation-guard/demo-output/demo.mp4

Validation

• node project-role-delegation-guard/test.js
• node project-role-delegation-guard/demo.js
• node --check project-role-delegation-guard/index.js
• node --check project-role-delegation-guard/test.js
• node --check project-role-delegation-guard/demo.js
• node --check project-role-delegation-guard/sample-data.js
• ffprobe -v error -show_entries format=duration,size -show_entries stream=codec_name,width,height -of default=noprint_wrappers=1 project-role-delegation-guard/demo-output/demo.mp4
• git diff --check
• git diff --cached --check