Iankhou gen2 migration codebuild e2e cleanup

[iankhou]

Description of changes

CodeBuild Infrastructure

Added the complete CodeBuild pipeline for running Gen2 migration E2E tests:

• gen2_migration_pr_workflow.yml — batch workflow that builds the CLI, publishes to Verdaccio, builds the linux pkg binary, then runs all migration apps in parallel
• run_gen2_migration_e2e.yml — per-app buildspec that loads the cached binary and runs a single migration test
• upload_pkg_binaries_linux_only.yml — uploads only the linux binary (the migration workflow doesn't need macOS/Windows)
• cloud-gen2-migration.sh — CI entry points for triggering the workflow
• _runGen2MigrationE2E in shared-scripts.sh — configures AWS credentials via a named profile, unsets credential env vars to avoid SDK conflicts, bootstraps CDK, configures git identity, and runs the migration test
• _uploadPkgBinariesLinuxOnly in shared-scripts.sh — caches only the linux binary to S3

Resource Teardown

Added a --teardown CLI option that cleans up all deployed resources after test execution:

• Deletes Gen1 root CFN stacks matching the deployment name prefix via the CloudFormation SDK
• Deletes the Amplify console app via the Amplify SDK
• Deletes the Gen2 sandbox via ampx sandbox delete --yes
• Finds and deletes holding stacks (CFN stacks with -holding suffix created during refactor)

This uses direct SDK calls instead of amplify delete because the migration mutates the workspace and breaks amplify delete. The teardown runs in a finally block so it executes whether the test passes or fails. All migration app package.json files pass ${TEARDOWN:+--teardown}, and the buildspec sets TEARDOWN=1.

--RoleArn option

Added a --roleArn Gen 2 Migration CLI option that takes an IAM Role ARN, which the Gen 2 Migration CLI uses to assume a role and get/refresh credentials for running the migration.

• May not be used with --profile option
• Must have administrator rights

Git Init Fix

Changed git init to git init --initial-branch=main in git.ts so the default branch is always main. This fixes checkout failures in CodeBuild where the default branch name is master.

Binary Packaging Fix (yao-pkg/pkg#195, yao-pkg/pkg#189)

A yarn.lock drift bumped get-intrinsic from 1.3.0 to 1.3.1, which added async-function, async-generator-function, and generator-function as new dependencies. These packages ship with a "module-sync" export condition that points to .mjs entry points. Inside pkg's snapshot filesystem, the ESM module resolution triggered by module-sync fails with ERR_MODULE_NOT_FOUND.

The fix patches the affected packages during generatePkgCli by stripping the "module-sync" line from their package.json via sed. Node then falls through to the "default" condition which points to a CJS file that pkg handles correctly.

Description of how you validated changes

CodeBuild runs in an account dedicated to E2E workflow runs. Uses existing CodeBuild job AmplifyCLI-E2E-Testing.

Checklist

• PR description included
• yarn test passes
• Tests are added
• Relevant documentation is changed or added (and PR referenced)
• New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies
• Pull request labels are added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.