Restrict PCS prod privileged access to SAW ALT accounts only

As a follow-up item from the 1CS review, restrict privileged access to PCS production to SAW (Secure Access Workstation) ALT accounts only.

## Context
Part of the 1CS follow-up work tracked in the parent epic. See https://github.com/dotnet/arcade-services/issues/6448 for related 1CS workitems.

Currently, privileged access to PCS prod may not be limited to SAW ALT accounts, which is a compliance/security requirement. This item tracks the work to enforce that restriction.

## Tasks
- [ ] Identify current privileged access paths/roles for PCS prod
- [ ] Determine which accounts require SAW ALT enforcement
- [ ] Implement access restrictions to require SAW ALT accounts for privileged access
- [ ] Validate the restriction is enforced and document the change