fix: use the AWS Query protocol for CloudWatch metrics

[alongubkin]

The metrics client sent JSON with an X-Amz-Target header to CloudWatch's Query API. Real AWS returned HTTP 404 <UnknownOperationException/> for GetMetricData; the AWS observer also uses this client for its ListMetrics availability probe.

Send signed form requests with Action/Version and member-indexed parameters, then decode XML results, timestamps, dimensions, pagination and provider errors. Public request/response models stay unchanged. Reusing the existing signer and XML transport avoids adding an SDK dependency.

Validation: four HTTP protocol/error tests pass (cargo test -p alien-aws-clients --lib aws::cloudwatch::tests). On the real E2E AWS target, the same Standard vCPU usage request now returns one Complete series (empty timestamps/values in the idle region), and ListMetrics returns 415 metrics successfully. Both calls are read-only; no cloud resources or quotas changed. The local real-read build enables system CA roots for the test environment and keeps TLS verification enabled. The HTTP regressions now cover multiple queries, samples, filters, metrics, dimensions and owning accounts, plus empty series and dimensions. Greptile's P2 list-edge-case finding is fixed in 0d00bb7; its previous 4/5 reviewed 2b5ffd7. Public request/response models and stored data stay unchanged; no permissions or dependencies were added.

Current-head 0d00bb77c CI is green, mergeable, and Greptile re-reviewed it at 5/5, with no outstanding findings. The HTTP regression finding is resolved. Enclave passed, and the subsequent Greptile rerun also returned 5/5 on this head. Ready for review; no merge performed.

🤖 Generated with Claude Code

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge, with no outstanding findings.

Summary

The PR switches CloudWatch calls from JSON to signed AWS Query requests and reads XML responses. Public models remain unchanged.

• CloudWatch metrics calls use AWS Query requests and XML results.

_{Reviews (3) · Last reviewed commit: "test: cover CloudWatch query list edge c..." · Reviewed by Greptile}

[alongubkin]

@greptileai review