[jmgasper]

The policies command made offline IAM provisioning appear to be part of application deployment. Remove that command and the role_policy / trust_policy generators so tcdeploy.py exposes only deploy and check-auth.

Update the usage, migration and authentication documentation to point administrators to the existing private v6-services-iac/services/<repository>/deploy/iam/ definitions. Explain that the STS session policy restricts a temporary session and does not create policies, assign roles, or expand the installed role's permissions. Runtime STS restrictions and deployment behavior are retained. Existing IAM definitions are already in the private repository; no infrastructure changes or consumer pin updates are included.

Validation:

• All 102 tests pass inside the pinned CircleCI AWS executor with networking disabled, including the real AWS CLI parsing test.
• Host suite passes (one AWS CLI integration test skipped because the host has no AWS CLI).
• New regression coverage verifies that policies is rejected before manifest reads or AWS calls, and help lists only runtime commands.
• All shell syntax checks and git diff --check pass.

This intentionally removes the policy-generation CLI/Python helpers. Existing published tags and pinned consumers remain unchanged; adopting this cleanup requires a new release and updated pins.