refactor(audit): drop pre-yolo:scope inference fallback

[stevethomas]

Hey, I made a thing! 🥳

What problems are you solving?

Clean-up follow-up to #83. Audit::scope() carried a backwards-compat inference fallback: when a resource had no yolo:scope tag, it guessed the scope — app-scope from a yolo:app tag, account-scope from the OIDC provider's ARN shape, env otherwise. That existed only for resources synced before the yolo:scope tag rollout.

Sync now stamps yolo:scope on everything it creates (via ResolvesTags, for every scope — including the account-global OIDC provider, which explicitly carries yolo:scope=account). So the inference is dead weight, and we don't need the back-compat.

• scope() now reads the yolo:scope tag and nothing else.
• A resource with no yolo:scope is, by definition, not YOLO-scoped — an unexpected/unowned resource — and is bucketed under env for display.
• Removes the isAccountGlobal() helper and the Arn argument that only the inference needed.
• Drops the back-compat test; tightens the scope test to the tag-only model.

Is there anything the reviewer needs to know to deploy this?

• No behaviour change for any current resource. Every YOLO-managed resource carries yolo:scope today, so it always hit the explicit-tag arm anyway — including the OIDC provider. The removed arms only ever fired for pre-rollout (un-re-synced) resources, which is exactly the back-compat we're dropping.
• Pure read-side classification; no AWS calls, no infrastructure change.
• 517 tests pass · phpstan clean · pint clean.

🤖 Generated with Claude Code