Add enterprise SSO certificate rollover guard

[jaxassistant55]

/claim #19

Summary

• add a self-contained enterprise-sso-certificate-rollover-guard module for Enterprise Tooling
• evaluate synthetic SAML/SSO metadata before enterprise certificate rollover release
• detect primary certificate hard-freeze risk, missing or insufficient staged cert overlap, weak signing algorithms/key sizes, stale IdP metadata, ACS/entity ID drift, stale downstream refresh evidence, and missing fallback/owner/ticket evidence
• emit deterministic release decisions, finding remediation, audit digest, and JSON/Markdown/SVG/MP4 reviewer artifacts

Why this slice is distinct

This focuses only on institutional SSO signing-certificate rollover readiness before metadata release. It avoids existing #19 work around SCIM deprovisioning, broad identity provisioning drift, webhook payload redaction/delivery, API rate limits, integration contract drift, repository sync SLA, admin dashboards, connector certification, vendor DPA review, data residency, and secret rotation.

Demo artifacts

• enterprise-sso-certificate-rollover-guard/reports/demo.mp4
• enterprise-sso-certificate-rollover-guard/reports/summary.svg
• enterprise-sso-certificate-rollover-guard/reports/rollover-review-report.md
• enterprise-sso-certificate-rollover-guard/reports/rollover-review-packet.json
• cd enterprise-sso-certificate-rollover-guard && npm run demo

Verification

cd enterprise-sso-certificate-rollover-guard
npm run check
npm test
npm run demo
ffprobe -v error -select_streams v:0 -show_entries stream=codec_name,width,height,duration -of default=noprint_wrappers=1 reports/demo.mp4
cd ..
git diff --check

Local results:

enterprise-sso-certificate-rollover-guard tests passed
Decision: block_metadata_release
Tenants: 4
Critical findings: 8
Warnings: 11
Audit digest: ccab61ff4ae3d58c244abd793cdafa209c0dfd6a6ae9e06bb01a629f43bc17d2
codec_name=h264
width=1280
height=720
duration=6.000000
git diff --check passed

All tenant names, domains, ticket IDs, and fingerprints are synthetic. No IdP calls, SCIM/HRIS calls, raw certificates, credentials, payment systems, private tenant data, or external APIs are used.

AI-assisted with OpenAI Codex; I reviewed and locally verified the implementation before submission. Attempt registration: #19 (comment)