Identity control-plane operations

Bind the consent policy, not the admin role: Entra's answer to the agent consent queue

A custom directory role scoped to one app consent policy lets a delegate approve tenant-wide consent only inside a named envelope. The queue does not vanish; it becomes policy maintenance.