Bulk-replace user roles (async)

Replace each listed user’s role with the given roleId (Authzed role-replace). roleId is a custom role owned by the caller, or a shared pre-built role other than Owner. When GA role selection is on, the assignable pre-built names are Administrator, Power user, and Workflow-only; any other pre-built name is ROLE_NOT_FOUND. A mapping to the Owner role is ROLE_CHANGE_FORBIDDEN, as is a mapping for a platform administrator, an existing Owner, or the API caller. assignments is 1…500 rows; each userId may appear only once. Async — returns 202 + JobAck; poll GET /v2/admin/jobs/{jobId} (kind: role-assignments.update) for per-row outcomes. Idempotent when the user already holds the target role (result: unchanged). On Workday-managed tenants the worker also syncs the role to Rolodex (role-only); a row is reported applied only after both Pilot and Rolodex accept the role. Evisort-managed tenants skip Rolodex. Rolodex sync failures surface as ROLE_UPDATE_FAILED in outcome.failed[] (no Rolodex detail is returned); resubmitting the same mapping heals Rolodex without duplicating Pilot writes or audit entries. Unknown users, unknown or ineligible roles, and forbidden role changes land in outcome.failed[] as { userId, roleId, code } (not full JSON:API errors); sync 400s below create no job.