feat(P02): l1-iam-role manifest + mock_apply (T-2.2)

---ci---
phase: 2
milestone: v1.0
status: execute
persona: infra-stub-engineer
task: T-2.2
requirements:
  covered: [REQ-02, REQ-03]
---/ci---

Wave 1, task T-2.2. Creates modules/l1/l1-iam-role/ with manifest.yaml
(flat inputs per D-017) and the uniform mock_apply.sh (D-007 + D-018).

modules/l1/l1-iam-role/manifest.yaml

@@ -0,0 +1,10 @@
+name: l1-iam-role
+kind: l1
+description: Identity and access role primitive
+inputs:
+  role_name:
+    description: Name of the IAM role to create
+    type: string
+  trust_policy:
+    description: JSON trust policy document defining who can assume the role
+    type: string

modules/l1/l1-iam-role/mock_apply.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+echo "[L1: l1-iam-role] applying..."
+sleep 1
+echo "[L1: l1-iam-role] OK"
+exit 0