docs: clarify AWS sync operations

[captainpacket]

Summary

• separate AWS Organizations discovery permissions from member-account collection-role permissions
• explain that setup-level success can coexist with per-account collection failures
• add multi-setup preflight, dry-run, and apply examples
• document review-gated removals and an Organizations visibility versus sts:AssumeRole decision table

Why

Operators need a clear way to distinguish retired or moved AWS accounts from active accounts with broken IAM configuration. The previous guidance covered the individual prerequisites but did not connect the discovery and collection signals into an operational decision.

Impact

This makes automation safer by showing when to repair IAM, when to investigate Organizations discovery, and when a removal can be approved. Public examples use generic setup IDs.

Validation

• go test ./...
• git diff --check