Add enterprise LMS roster passback guard

[haki203]

Summary

• Adds a distinct enterprise LMS roster and grade-passback guard slice for issue Enterprise Tooling #19.
• Validates Canvas/Moodle roster snapshots and grade passback events before institutional sync.
• Flags out-of-scope course sections, stale dropped enrollments, missing ORCID/profile linkage, missing FERPA-safe consent, grade release-window violations, and missing webhook acknowledgements.
• Emits deterministic reviewer decisions, required actions, JSON/Markdown/SVG reports, and a short MP4 demo artifact from synthetic data only.

Validation

• node enterprise-lms-roster-passback-guard/test.js
• node enterprise-lms-roster-passback-guard/demo.js
• node --check enterprise-lms-roster-passback-guard/index.js
• node --check enterprise-lms-roster-passback-guard/test.js
• node --check enterprise-lms-roster-passback-guard/demo.js
• node --check enterprise-lms-roster-passback-guard/sample-data.js
• ffmpeg decode check for enterprise-lms-roster-passback-guard/reports/demo.mp4
• git diff --cached --check

No live LMS calls, student records, credentials, external APIs, or network calls are used by the module.

/claim #19