feat: validate aggregate IAM policy and template limits

[alongubkin]

Oversized AWS role policies now fail before cloud setup or template output. The build/runtime checks aggregate inline policy characters per role (10,240), bound managed-policy attachments (20), and validate final CloudFormation/Terraform role documents. Shared policy selection/rendering and physical-name helpers keep the calculation aligned with controller writers; incomplete dynamic inputs report their limits explicitly.

Existing before/after evidence:

• Direct build rejection, original parent acceptance, small control and limitations.
• Native Terraform before/after/setup and provider cleanup.
• Native CloudFormation before/after/setup and provider cleanup.
• Aggregate rejection before provisioning, small control, parent saved native failure.

The native negative parent controls created partial IAM resources; feature rendering rejected with no output files. Positive native setups completed, then normal cleanup removed owned resources. These are existing integrated-feature runs, not reruns on the split commit. Full resolution of every retained/dynamic management policy is not claimed.

No cloud read permissions, protocol/controller-state changes or SDK fields are added by this layer. Pure checks use existing configuration/context; current-stack ownership remains authoritative. Proper supported pnpm generate and drift checks passed in feature CI38534727697. Independent layer CI and current-head review have passed.

Merge order: #1032 → #1026 → #1027 → #1028 → #1029 → #1030. Each layer depends on the preceding PR; human merges only.

The Terraform attachment-reference counting finding remains fixed and covered by the emitted-chunk regression. The latest head inherits the validated AWS/GCP review fixes without additional changes in this layer.

Current head ec729bbff: CI green, Greptile 5/5, mergeable and ready for review (review).

🤖 Generated with Claude Code

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[High impact] This PR appears safe to merge after its base PR.

Summary

This PR adds early AWS IAM quota checks and checks the final CloudFormation and Terraform output.

• AWS preflight checks catch oversized role policies before setup.
• AWS setup checks policy batches before writing them.
• CloudFormation generation rejects AWS roles that exceed IAM limits.
• Terraform generation rejects AWS roles that exceed IAM limits.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Stack configuration] --> B[Build-time IAM check]
  B --> C[Prepared stack and deployment values]
  C --> D[Direct setup aggregate check]
  D --> E[Runtime policy checks]
  E --> F[AWS writes]
  C --> G[CloudFormation or Terraform generation]
  G --> H[Final role quota check]
  H --> I[Template output]

Loading

_{Reviews (6) · Last reviewed commit: "feat: validate aggregate IAM and templat..." · Reviewed by Greptile}

[alongubkin]

@greptileai review