Backstop for the payout identity gate (payout_identity.py).

Identity can attach where no backend call sees it — an email verified through the dashboard's Firebase reset link flips email_verified on the Auth user only. This sweep re-checks every profile whose brand tokens are held for identity and releases the ones that now qualify. Idempotent; a profile still lacking identity is left held and counted. Cloud Scheduler hourly is plenty: nothing is lost while held.