Move WorkOS backfill to local script

[tgmendes]

Summary

• move the WorkOS backfill out of Temporal activities into a local Go command
• add phased preflight/write/validate flows for global roles, organizations, users, memberships, and role assignments
• add a WorkOS backfill runbook under docs/runbooks

Verification

• rtk env GOCACHE=/private/tmp/gram-gocache go test ./server/cmd/workos-backfill
• rtk mise lint:server

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gram-docs-redirect	Ready	Preview, Comment	May 18, 2026 3:17pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 721e1da

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR