Create a WorkOS Magic Auth identity (no password — Magic Auth doesn't need one) for every active vendor contact missing one in the target environment, in the same shape _ensure_workos_identity and provision_workos_user use, so a backfilled contact and a lazily-created one are indistinguishable. Names are passed so the WorkOS dashboard is legible.

Processes the full contact set in a single request — this can be a long request on a large tenant. Each email is created independently under its own try/except, so one bad address can't strand the rest, and failures are collected rather than aborting the run. A re-run converges to zero creates because the existence diff against WorkOS is recomputed fresh each time.