Task: Bind ores.iam entities to profiles; verify zero-diff regen

Survey every ores.iam entity (projects/ores.iam/modeling) against the profile catalogue, rebind matches, regenerate, and require zero additional diff against the pre-rebind checked-in output.

• Every entity discovered under projects/ores.iam/modeling is surveyed against all Variability Profiles.
• Every matching entity is rebound and regenerated with zero additional diff versus its pre-rebind checked-in output.
• No-match entities are recorded with their actual feature values, not silently dropped.
• The tenant_type has_tenant_id model/table drift is resolved as part of this survey, not carried forward as a separate open item.
• The known service_find_prefix gap on tenant_type and tenant_status is resolved as part of reaching zero drift.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Manual QA scenarios (scaffolded via compass add test_scenario, run through the QA Validation Runner panel) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.