#9429 fix(scim): harden directory lifecycle and clarify group mappings

Summary

• Serialize Chat admission with SCIM suspension, keep stopped runs stopped after reactivation, and revoke OAuth grants on permanent removal.
• Withdraw stale automatic group mappings after renames and read membership-lock and name-matching settings after acquiring the organization lock.
• Show automatic mappings and unassigned policy memberships, refresh affected permission caches, correct empty-policy descriptions, explain mapping conflicts and removal consequences, and update the SCIM, Okta, and Entra guides with a current screenshot.

Type of Change

• Bug fix

Testing

• Real app HTTP suite: 28 scenarios and 181 requests, including Okta/Entra payload emulation. Real PostgreSQL/Redis integration suite: 68 tests. Regression negative controls fail before each fix.
• Admin UI: 16 browser checks, including cached member lists after adding and removing a mapping. Documentation: production build, three guides at 12 viewport widths, provider tabs, screenshot viewer, and links.
• Full repository tests, lint, type-check, all 61 audits, test-type ratchet, artifact generation, and block-registry check pass. Cleanup and test-audit have no remaining findings.
• This run used provider-shaped requests; it does not establish new live-provider validation or certification. The guides retain the scope and limitations of earlier live tests.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)