Prod changeset sync — Stage 1: infra prep (bucket + dedicated IRSA role)

[arielr-lt]

Draft / planning — Stage 1 (infrastructure prep) for enabling registry changeset sync in production. Additive only; does not touch the running prod app. Not to be applied until the app cutover (Stage 2) is planned and the Publisher side is confirmed.

What this adds

• S3 bucket cer-registry-changesets-prod (versioning + AES256 + public-access-block).
• Dedicated prod IRSA role ce-registry-eks-prod-application-irsa-role, trusting only credreg-prod:main-app-service-account — isolates prod from the shared staging/prod role.
• Scoped policy = the buckets prod actually uses (verified against S3 code paths + DB config):
  cer-envelope-downloads, cer-envelope-graphs-prod-us-east-1, ocn-exports (prod ce_registry OCN export is enabled), cer-registry-changesets-prod.

Read-only plan: 8 to add, 0 to change, 0 to destroy (for these resources).

Deferred to Stage 2 (app cutover) — intentionally not here

• Repoint prod SA → new role + remove credreg-prod from the shared role trust (needs a pod roll).
• Configmap REGISTRY_CHANGESET_SYNC_* vars, image bump, DB migration, backlog handling.

Open items

• Publisher endpoint URL (placeholder api.publisher.credentialengine.org), tenant mapping for ce_registry/fdoe, allowlist of egress 107.21.182.55 (same as sandbox — likely already done). Pending Cary.
• Apply approach: targeted applies vs. clearing the pre-existing Phase 2 terraform drift first (env is currently apply-frozen).

Note on the CI plan

A full plan here will also show the pre-existing Phase 2 drift (db-dumps policy, ng_sandbox_large min_size, rds-sandbox SG) — those are not from this PR.