fix(kubernetes_cluster): race-safe exec provider for authenticator install

[rauneetverma]

Summary

• eks_standard/1.0, eks_automode/1.0, gke/1.0: Replace non-race-safe authenticator install (direct /tmp download) with flock-serialized, atomic-rename pattern
• Extracts kubernetes_provider_exec into a dedicated local so both output_attributes and output_interfaces reference a single definition
• Prevents exit 126 (partial binary write) when multiple Terraform providers exec the install script concurrently at plan start

Problem

All providers (kubernetes, helm, kubectl) exec the authenticator install script concurrently at plan start. The old approach:

1. Downloaded to a shared /tmp/aws-iam-authenticator path
2. Had no locking — concurrent downloads corrupted the binary
3. Resulted in exit 126 (cannot execute binary file)

Error:

Error: Get "https://4924E44147D54FA4CDFF4E71411664B9.yl4.ap-southeast-1.eks.amazonaws.com/api/v1/namespaces/default/secrets/mongo-user-mongo-ro-user": getting credentials: exec: executable bash failed with exit code 126

Fix

• flock serializes the install to one process at a time
• Double-check inside the lock avoids redundant downloads
• mktemp inside /usr/local/bin + mv -f = atomic rename (same filesystem)
• A concurrent exec sees either no binary or a complete one, never a partial write

Test plan

• Verify raptor create iac-module --dry-run passes for all three modules
• Confirm concurrent provider exec no longer causes exit 126

🤖 Generated with Claude Code