[AWS] Implement role assumption, identity verification, and capability discovery #52

Outcome

Fail closed unless scoped credentials resolve to the intended account, partition, region, and permissions.

Scope

• Acquire short-lived sessions, verify identity, discover capabilities, and preflight required read/write permissions without broadening authority.

Acceptance criteria

• Account, partition, and region mismatches fail closed.
• Expiration, refresh, revocation, and insufficient permissions are tested.
• A least-privilege policy is documented and no long-lived access key is required.

Test and evidence

• Identity/capability test matrix and policy analysis.

Dependencies

• Blocked by #51.
• Blocked by #39.

References

• Security model
• Architecture overview