Review who holds admin in ServiceNow and who should not

**Objective:** List everyone holding role `{role}` (default admin) and flag grants that should be reviewed, treating no login in `{stale-days}` days (default 90) as stale.

**Step 1: Pull the grants**

Call `servicenow-get-user-role` with role `{role}` (admin if blank) and state Active.

**Step 2: Check each holder**

For each distinct user call `servicenow-get-user` with name set to them. Note active, last-login-time, department, title and manager.

**Step 3: Apply the rules**

Flag a grant when:

* the user is inactive (should have been removed)
* last-login-time is older than `{stale-days}` days, or empty
* inherited is false (a direct grant that bypasses group-based access control)
* the user holds it both directly and inherited (redundant direct grant)
* granted-by is empty for a direct grant (no audit trail)

For inherited grants, call `servicenow-get-group-member` with user set to the holder to name the groups it could come from.

**Step 4: Report**

* Totals: holders, direct grants, inherited grants, flagged.
* A table, flagged first: user, user-id, active, last login, department, direct or inherited, granted-by, groups, flags.
* Recommended removals, each with the reason.

**Rules & Guidelines:**

* Read-only. Do not call `servicenow-add-user-role`, `servicenow-update-user-role`, `servicenow-update-user`, `servicenow-add-group-member` or any other add- or update- tool.

**Validation:**

* If nobody holds `{role}`, say so and check the role name.