[AWS] Implement scoped workload identity #54

Outcome

Give workloads narrowly bounded AWS authority with safe trust and ownership rules.

Scope

• Reconcile roles, trust conditions, policy attachments, session tags/external IDs where applicable, and stable ownership.

Acceptance criteria

• Wildcard and known privilege-escalation permissions are rejected or explicitly approved.
• Trust policies bind the intended workload and environment.
• Create, update, no-op, and delete are idempotent.

Test and evidence

• Policy simulation, escalation-negative, and lifecycle tests.

Dependencies

• Blocked by #52.
• Blocked by #53.
• Blocked by #25.

References

• Security model