ADR-24 SP2a Rails side complete Warden strategy (lib/gitlab/auth/devise/strategies/iam_cookie_injection.rb), IamCopyGuard (app/models/concerns/iam_copy_guard.rb), IamHomeCellRedirector and IamTagEcho controller concerns, X-Iam-User-* sign-in response headers, and the ADR-24 users migration (home_cell_id, is_copy, identity_tag, identity_version, generation + per-table identity_version). Gated behind ENV ADR24_IAM_WARDEN=1. CP2 acceptance passes against the live gitlab-caproni cells rig at tag cp2-passing. Companion to mikeeddington/gitlab-caproni cp2-passing and mikeeddington/iam-sts cp2-passing.