The thing about FedRAMP is that it's not one thing, it's a framework. Even if you have a FedRAMP package for a system, you need a fresh ATO to use it at any customer.

Technically, there is no citizenship requirement for FedRAMP.

In reality, at every US Government customer I'm aware of, US Persons (Citizen or PermRes) are the only ones that can deploy code to production. You can have non-USP writing code but it must be reviewed and rolled out by USP.

now now, no one wants to call out the unwillingness to pay fair labor cost of the sausage machine :^)