Align IAM binding agent kinds with the manifest schema

[cassi-volkova]

Summary

• register the canonical em_core_iam_permission_bindings and em_core_iam_role_bindings kinds emitted by the manifest schema
• retain the legacy singular kinds as compatibility aliases
• migrate persisted core-agent configuration during bootstrap and restart only ec-core-agent when a change is needed
• update the bundled IAM example to use the canonical role-binding resource path

Closes #522.

Validation

• pytest -q -n 10 exordos_core/tests/unit — 222 passed
• ruff check . — passed
• focused migration tests — 3 passed
• targeted mypy reported only existing errors outside the changed lines

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[cassi-volkova]

Closing this approach. The IAM binding resource kinds remain the existing singular rolebinding and permissionbinding kinds; the consuming manifest will use those canonical names directly.