B4 post-deploy check (spec 36, 2d) — device claim origins in identity

Read-only Neon prod audit of identity.ThirdPartyClaim device claims with source BULK_IMPORT/CONNECT_FLOW. Verify sourceRecordId provenance vs connect.WorkspaceSystemConnection / LinkSession, source<->linkSessionId agreement, and live-CUSTOMER thirdPartyId. Result: OK, 13 live claims, all consistent.