Add setup-aws.sh: idempotent AWS provisioning for the EKS MVP (#309)

[ealt]

Summary

• Adds reference/scripts/setup-aws/setup-aws.sh: idempotent, create-if-absent provisioning of everything the EDEN Helm chart needs upstream of setup-experiment-helm.sh on AWS (issue Idempotent AWS provisioning script for the EKS MVP (setup-aws.sh) #309, AWS MVP milestone). Replaces the chart README's manual AWS checklist with a one-pass script; the manual steps stay as the substrate-agnostic fallback.
• Five steps, each probe-then-create and convergent on re-run (the setup-experiment.sh / repo_init idempotency idiom): EKS verify-or-create (+ IAM OIDC provider + the aws-ebs-csi-driver addon that PVC provisioning needs on modern EKS), ECR repo + reference-image build/push, RDS Postgres in the cluster VPC (AWS-managed master password, re-read from Secrets Manager on re-run) or an operator --postgres-dsn, S3 bucket + IRSA role scoped to exactly the chart's <fullname>-task-store-server ServiceAccount, and a generated 0600 Helm values file + the exact setup-experiment-helm.sh handoff invocation.
• No fictional defaults: every resource name + region is operator-supplied; a missing flag fails loud naming the flag. --dry-run prints every mutating command verbatim through a single gate and redacts all secret material from the preview. State reads go through probe_* functions overridable via EDEN_SETUP_AWS_MOCK, which drives the offline test-setup-aws.sh (97 checks, bash-3.2-clean).

Advances the AWS MVP milestone (the chart deploys on EKS as of 13a/13c/13d; this makes the upstream AWS provisioning a script instead of a manual checklist).

What this does NOT cover

• Teardown / deprovisioning — no reverse-order delete of the provisioned resources; they bill until removed by hand. Tracked in Teardown counterpart for setup-aws.sh (delete provisioned AWS resources) #314.
• CI execution of the bash test suite — test-setup-aws.sh (97 checks) and shellcheck on these scripts run only manually today; no CI job executes them. Tracked in CI job for shellcheck + bash test harnesses (setup-aws dry-run suite has no CI executor) #315.
• A real end-to-end provisioning run — validated exclusively through --dry-run + the mock harness; the first real AWS run is operator-attended by design (provisioning costs money and touches a shared account). No live-AWS assertion in this PR.
• DNS / Ingress provisioning — out of scope per the issue; tracked with the Hosted Web UI ingress work in Web-UI external access: Ingress + TLS for the Helm chart #308.
• GCP / Azure siblings — AWS first; the script's probe/mutate split is the structure a setup-gcp.sh mirrors (noted in Idempotent AWS provisioning script for the EKS MVP (setup-aws.sh) #309's out-of-scope; not separately filed).

Fresh-operator walkthrough

• A fresh-operator walkthrough was performed against the changed surface (the new CLI).
• Notes: ran --help (usage lists required vs create-only-required flags); ran with a missing required flag → fails loud naming it (setup-aws.sh: --ecr-repo is required); ran a full fresh-account --dry-run against the mock — emits the 5 steps in dependency order, the values-file preview shows secrets as <generated> and the DSN userinfo as <redacted>, and the handoff prints the exact setup-experiment-helm.sh --values invocation with --namespace/--release matching the IRSA trust subject. Passed cleanly.

Test plan

• shellcheck clean on both scripts.
• bash-3.2 compatibility — suite green under macOS /bin/bash 3.2.57 (no mapfile / declare -A).
• bash reference/scripts/setup-aws/test-setup-aws.sh — all 97 checks pass (all-absent / all-present / partial-state / interrupted-create / foreign-policy / flag-validation fixtures).
• --dry-run end-to-end against the mock — correct command sequence + skip paths + secret redaction.
• Pre-push gate (rename-discipline, complexity-gate, ruff, pyright, docs-lint) — clean.
• npx markdownlint-cli2@0.14.0 (CI-pinned) — 0 errors.
• Synchronous codex review, 3 rounds (round 0 fix-then-ship: 1×P1 + 6×P2 all addressed; round 1 → semantic policy check; round 2 ship). Record under docs/plans/review/setup-aws/impl/.

Related issues

• Closes Idempotent AWS provisioning script for the EKS MVP (setup-aws.sh) #309 — Idempotent AWS provisioning script for the EKS MVP (setup-aws.sh)
• Refs Teardown counterpart for setup-aws.sh (delete provisioned AWS resources) #314 — teardown counterpart (deferral, filed)
• Refs CI job for shellcheck + bash test harnesses (setup-aws dry-run suite has no CI executor) #315 — shellcheck + bash-test CI job (deferral, filed)
• Refs Web-UI external access: Ingress + TLS for the Helm chart #308 — DNS/Ingress provisioning (pre-existing out-of-scope)

🤖 Generated with Claude Code