🔐 Employee Exit & Role-Change Access Reconciler

Employee Exit & Role-Change Access Reconciler turns normalized HR events, account exports, exception records, and revocation evidence into a deterministic closeout gate. It flags active access after departure, old-role entitlements, accounts outside the supplied SSO boundary, expired or unowned exceptions, and revoked status without verified proof. It writes an evidence ledger, findings, summary, and review memo. It never connects to an identity provider, revokes access, changes an account, or claims compliance.