Register Sample Arns

Register sample-scoped IAM ARN(s) — grants access to ALL sample datasets the client is entitled to (present + future). Enqueues a sample fan-out per newly-active ARN.