Reconcile every Team workspace's occupied seats against what it purchased.

Flags first drift with a heal-grace banner, suspends the newest over-quota seats once past the grace (never an owner's), and heals back down when the drift resolves. Idempotent and time-gated, so it is safe to run on a fixed cadence -- and a strict no-op while Teams is dark, since no tenant is workspace_kind=team yet. Runs under the launcher identity like the other reconcilers; the launcher tick is wired separately (engine-worker).