Provisioning Account Assignment on Access List is unreliable

[tcsc]

Expected behavior:

When I assign an Account-Assignment granting role to an Access List, I expect that

1. A downstream group will be provisioned into IC, and
2. That group will have Identity Center account assignments provisioned on it

Current behavior:

The downstream group is provisioned, but sometimes no permission sets are applied.

Examining the backend, it looks like the provisioning states are holding on to outdated External IDs.

May be related to #48959, given that provisioning and account assignment records are not being correctly cleaned up.