Seed scoped idle_checker permissions into RBAC roles and fixtures

Seed role permission rows for the open-string entity type "idle_checker" so scoped enable/disable can pass enforcement. Add idle_checker to the target types of scripts/generate-rbac-fixture-permissions.py and regenerate fixtures/manager/example-roles.json. Add an alembic migration seeding (scope, "idle_checker", READ|UPDATE) for admin roles and READ for member roles.

Do NOT add a legacy RBAC_ACTION_REGISTRY declaration or VALID_SCOPE_ENTITY_COMBINATIONS entry yet - that surface is advertising without enforcement (the exact #13557 review finding) and is deferred until after the scope-shape action lands (BA-7238), or dropped with the deprecating enum stack.

## Success Criteria
- [ ] regenerated example-roles.json grants admin roles UPDATE on idle_checker in their scope
- [ ] migration is idempotent: re-running adds no duplicate permission rows
- [ ] with the seed applied, the BA-7238 scope permission check passes for a project admin
- [ ] pants test passes for affected packages

JIRA Issue: BA-7240

Start with scripts/generate-rbac-fixture-permissions.py and the existing fixtures/manager/example-roles.json to understand target types and generated permissions. Review existing Alembic migrations that seed RBAC role permissions, then add the idle_checker rows with idempotent behavior. Regenerate the fixture and run pants test for the affected packages; done means the listed success criteria pass without adding the deferred registry or scope-combination entries.

Written by the indexing model from the issue text.