Find leavers who still have a Ramp login

**Objective:** For the NetSuite employees in department `{department-id}` (blank means all, capped at `{max-employees}`, default 200), confirm each has a matching Ramp user and report mismatches.

**Step 1: NetSuite employees**

Call `netsuite-get-employee` (netsuite server) with department-id `{department-id}` and max-records `{max-employees}`. Keep `internal-id`, `email`, `last-name`, `job-title`, `hire-date` and `termination-date`.

**Step 2: Ramp users**

Call `ramp-get-user` (ramp server) with max-records 500. Keep `email`, `first-name`, `last-name`, `status`, `role`, `employee-id` and `manager`.

**Step 3: Match**

Match on lowercased `email`. If an employee has no email, match on `last-name` plus a non-empty `employee-id` and label it low confidence.

**Step 4: Report**

Tables: employees with no Ramp user, Ramp users with no NetSuite employee in scope, employees with a `termination-date` in the past whose Ramp `status` is still active, and matched count. For leavers include the Ramp role.

**Rules & Guidelines:**

* Tools whose names start with netsuite are on the netsuite server; tools whose names start with ramp are on the ramp server. Both servers must be connected.
* This prompt is read-only. Call only the read (get) tools named in the steps. Never call any Add, Update, Delete, archive, suspend or sync tool on either server.
* Use only the filters named in each step. Set max-records to 200 unless told otherwise.

**Validation:**

* If `ramp-get-user` returns the cap of 500 rows, say the Ramp side may be incomplete.
* Do not deactivate or change any user; only report.