Find Ramp users who have left Business Central

**Objective:** Compare Ramp users with Business Central employees and report leavers who still have Ramp access, users with no employee record, and mismatched details. Limit to Ramp users with last name containing `{last-name}` when given. Read-only.

**Step 1: Read Ramp users**

Call `ramp-get-user` (Ramp server) with `last-name.contains` set to `{last-name}` when given and `max-records` 200. Keep `id`, `first-name`, `last-name`, `email`, `employee-id`, `role`, `status`.

**Step 2: Find each employee**

For each user call `business-central-get-employee` (Business Central server): with `employee-number` set to the Ramp `employee-id` when that is present, otherwise with `last-name` and `first-name` from Ramp. Keep `employee-number`, `status`, `email`, `company-email`, `job-title`, `employment-date`. Confirm a name match by also comparing email; never assume a surname alone is the same person.

**Step 3: Report**

Tables for: Ramp users whose status is active but whose employee `status` is not active (highest risk, list their Ramp `role`); Ramp users with no employee found; Ramp users whose email matches neither employee email; employees found by name only because the Ramp `employee-id` was empty. Finish with counts.

**Rules & Guidelines:**

* `ramp-get-user` is on the Ramp server; `business-central-get-employee` is on the Business Central server.
* Read-only. Do not call `ramp-user-deactivate`, `ramp-user-update` or `business-central-update-employee`; recommend deactivation in the report instead.

**Validation:**

* If Ramp returns no users, say so and stop.
* If a name search returns several employees, list the candidates and mark the user as ambiguous.
* Business Central employee status values are not Ramp's; show both raw values.