feat: add AWS runtime configuration

[glitchedmob]

Adds bootstrap-owned AWS account metadata for workload identity without storing account IDs in source.

• Scaffolds the OpenSGF account ID as a write-only SSM parameter with a CHANGEME initial value.
• Passes the parameter path into the generated Ansible inventory.
• Reads the SGF Devs account from the active AWS caller and the OpenSGF account from SSM.
• Applies both values through the kube-system/aws-runtime ConfigMap before Argo CD reconciliation.

[glitchedmob]

After the OpenTofu apply, replace CHANGEME at /vm-workloads/sgfdevs/infra-vm-workloads/opensgf-aws-account-id before running the Argo CD bootstrap.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-vm-workloads/actions/runs/33286409318

Show summary

CHANGE	RESOURCE

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY