fix: drop iam roles from github repository provider

AGENTS.md

@@ -31,5 +31,5 @@
 - CI: ensure pre-commit, TFLint, and tests pass. Avoid unrelated changes in the same PR.
 
 ## Security & Configuration Tips
-- Never commit secrets. Configure AWS credentials/role assumption externally; the provider setup in `src/providers.tf` supports role assumption via the `iam_roles` module.
+- Never commit secrets. Configure AWS credentials/role assumption externally; `src/providers.tf` only configures the AWS region for optional SSM and Secrets Manager lookups.
 - Global quotas must be applied in `us-east-1`; place in the `gbl` stack and set `region: us-east-1` in `vars`.

src/providers.tf

@@ -1,19 +1,3 @@
 provider "aws" {
   region = var.region
-
-  # Profile is deprecated in favor of terraform_role_arn. When profiles are not in use, terraform_profile_name is null.
-  profile = module.iam_roles.terraform_profile_name
-
-  dynamic "assume_role" {
-    # module.iam_roles.terraform_role_arn may be null, in which case do not assume a role.
-    for_each = compact([module.iam_roles.terraform_role_arn])
-    content {
-      role_arn = assume_role.value
-    }
-  }
-}
-
-module "iam_roles" {
-  source  = "../account-map/modules/iam-roles"
-  context = module.this.context
 }