Invite Ramp users with the right role and no duplicates

**Objective:** Invite `{full-name}` ({email}) to Ramp with role `{role-name}` and, if given, department `{department-name}`.

**Step 1: Check for an existing user**

Call `ramp-get-user` with `first-name` and `last-name` from the full name. If a matching user already exists, show it and stop.

**Step 2: Resolve the references**

* Call `ramp-get-role` with `name` and confirm the role exists. If not, list roles and stop.
* If a department was given, call `ramp-get-department` with `name` and use its id. If several match, list them and stop.
* Do not guess a location or manager. Leave them out unless the user names them.

**Step 3: Confirm**

Show first name, last name, email, role and department. Ask the user to confirm. Do nothing further until they say yes.

**Step 4: Invite**

Call `ramp-user-add` once, with a freshly generated UUID as `idempotency_key`. Then call `ramp-get-user` to confirm the user now shows as invited and report their id.

**Rules & Guidelines:**

* `ramp-user-add` is the only write tool allowed, and only after confirmation. Never call it twice.
* Never grant an administrative role unless the user named it explicitly.

**Validation:**

* If the email looks invalid, stop and ask.