feat: migrate aws-sdk v2 to @aws-sdk/client-ec2 v3 (Phase 1) (#17)

* feat: migrate aws-sdk v2 to @aws-sdk/client-ec2 v3 (Phase 1)

Completes Phase 1 (issue #7) of the modernization plan.

## Dependency changes

- Remove 'aws-sdk' ^2.809.0 (in maintenance mode since late 2024;
  end-of-support announced for Nov 2025; emits DEP0169 on url.parse()
  in modern Node).
- Add '@aws-sdk/client-ec2' 3.1033.0 pinned exact. Per-service package
  is dramatically smaller than v2's monolithic bundle.
- Bump '@vercel/ncc' 0.25.1 -> 0.38.4. The old ncc couldn't parse
  modern JS (private class fields in v3's transitive deps); 0.38 is
  webpack-5-based and handles current syntax.

## Code changes (src/aws.js)

Rewrite on the EC2Client + Command pattern:

- EC2Client({}) replaces 'new AWS.EC2()'. Reads region + creds from
  env (same behavior, same source — configure-aws-credentials or
  instance profile).
- client.send(new DescribeImagesCommand(params)) replaces
  ec2.describeImages(params).promise().
- client.send(new RunInstancesCommand(params)) replaces
  ec2.runInstances(params).promise().
- client.send(new TerminateInstancesCommand(params)) replaces
  ec2.terminateInstances(params).promise().
- client.send(new AssociateAddressCommand(params)) replaces
  ec2.associateAddress(params).promise().
- waitUntilInstanceRunning({client, maxWaitTime: 300}, {InstanceIds})
  replaces ec2.waitFor('instanceRunning', ...).promise().

External action contract (inputs + outputs) is unchanged. Consumer
workflows (notably terraform-provider-namecheap) do not need any
change beyond rotating their SHA pin.

## Bundle + CI

- 'npm run package' no longer needs NODE_OPTIONS=--openssl-legacy-provider
  (ncc 0.38 + webpack 5 don't use the legacy module-hash MD4 path).
- dist/ now contains code-split chunk files (136.index.js, 360.index.js,
  etc.) alongside dist/index.js. All must be committed; the verify-dist
  CI check in pr.yml is broadened to diff the whole dist/ tree.
- Bundle size: 7.9 MB -> 3.4 MB main (+ ~3.3 MB in chunks). Net smaller
  than v2.

## Backward compatibility

The DEP0169 process.emitWarning filter added in #6 stays in place.
The v3 bundle doesn't emit DEP0169, so the filter is effectively inert
on the current tip — cleanup is a follow-up, not part of this PR's scope.

## Verification

- npm test: 21 tests pass across tests/utils.test.js + tests/config.test.js
  (no aws.js tests yet; those land as Phase 8.b after Phase 4/5 stop
  rewriting aws.js).
- npm run lint: clean.
- Bundle builds cleanly on Node 20 without OpenSSL legacy provider.

Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com>

* chore: add .gitattributes to normalize line endings in dist/

ncc 0.38's output contains 451 source-embedded CR bytes inside string
literals (aws-sdk transitive deps). When dist/ is committed through
git's default line-ending normalization, those CRs are stripped into
the blob, but every subsequent 'npm run package' reproduces them —
creating a permanent, symmetric 451/451 diff that the verify-dist CI
gate correctly flagged as drift.

Mark the whole dist/ tree as binary via .gitattributes so git never
converts line endings in that path. What ncc writes is what git
stores; CI's rebuild produces byte-identical output.

Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com>

---------

Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com>

Author: kurok

.gitattributes

@@ -0,0 +1,6 @@
+# ncc-bundled output contains source-embedded CR bytes inside string
+# literals (aws-sdk deps, etc.). Treat the whole dist/ tree as binary
+# so git's autocrlf doesn't strip them on commit, which otherwise
+# produces a permanent mismatch between the committed blob and a
+# fresh `npm run package` rebuild.
+dist/** -text

.github/workflows/pr.yml

@@ -32,14 +32,16 @@ jobs:
       - name: Install packages
         run: npm ci
       - name: Rebuild dist
-        # @vercel/ncc 0.25.1 uses a webpack version that needs the
-        # legacy OpenSSL provider on modern Node for module hashing.
-        run: NODE_OPTIONS=--openssl-legacy-provider npm run package
+        run: npm run package
       - name: Fail if dist/ differs from committed copy
+        # ncc 0.38 produces code-split chunks alongside dist/index.js
+        # (e.g. dist/136.index.js); the whole dist/ tree must stay in
+        # sync with src/.
         run: |
-          if ! git diff --quiet -- dist/; then
-            echo "::error::dist/index.js is out of sync with src/."
-            echo "::error::Run 'NODE_OPTIONS=--openssl-legacy-provider npm run package' locally and commit the rebuilt dist/."
+          if ! git diff --quiet -- dist/ || [ -n "$(git status --porcelain -- dist/)" ]; then
+            echo "::error::dist/ is out of sync with src/."
+            echo "::error::Run 'npm run package' locally and commit the rebuilt dist/."
+            git status --porcelain -- dist/
             git diff --stat -- dist/
             exit 1
           fi