Harden credential cleanup and unblock Python CI

[alfdav]

Summary

Verified recon findings against main @ 354364f and landed the smallest correctness/safety/CI/test fixes. No roadmap features.

Verified and fixed

1. Installer leftover cleanup — cleanup_temp_files / cleanup_on_exit no longer rmtree("aws") or unlink installer zip/pkg names in cwd unless TempFox registered those paths as its own leftovers.
2. AKIA session token — empty AWS_SESSION_TOKEN is omitted (and inherited values are popped) for test_aws_connection and run_cloudfox_aws_all_checks.
3. Profile delete honesty — delete_aws_profile now returns the AND of the credentials/config write results, so --cleanup-profiles can report a failed write.
4. Expired token on all-checks — CloudFox nonzero exits that match EXPIRED_TOKEN_INDICATORS use the same warning as the connection test. No recursive main().
5. Access key input — AWS_ACCESS_KEY_ID uses getpass like secret/token. No documented reason to echo it.
6. CI Codecov — codecov-action@v3 + fail_ci_if_error: true on 3.11 is the hypothesized cause of the red test (3.11) job (upload exit 255, no CODECOV_TOKEN). Upgraded to @v5, fail_ci_if_error: false, continue-on-error: true. Does not invent a token. Do not treat CI as green until this workflow change has run on the PR.
7. tests/test_aws_profiles.py — real generate/list/create/delete/write/chmod tests against an isolated tmp ~/.aws.
8. CLI tests — --list-profiles, --cleanup-profiles, and --no-profile through main.
9. CloudFox tests — JSON vs raw-text wrapping, retention (MAX_OUTPUT_FILES), and the current “write files before returncode check” behavior.
10. LICENSE — standard MIT file matching the README copyright/body. GitHub LICENSE path 404 confirmed.

Verified and skipped

• Custom / default profile orphans — get_tempfox_profiles still only matches tempfox-*. That is why custom/default names are not removed by --cleanup-profiles. No new cleanup UX was added; delete return values are now honest, and tests document the prefix filter.

Test plan

• make hygiene-fast baseline on 354364f (32 passed)
• Failing tests first for the behavior changes, then implementation
• make hygiene after changes: ruff, format, mypy, pytest --cov-fail-under=35, repo-scan
• 55 passed, coverage 58.21%
• GitHub Actions on this PR: lint/typecheck/pytest should stay green on 3.8–3.12; 3.11 Codecov upload may still fail, but the job should not go red because of it

Residual risks

• install_aws_cli still downloads/extracts into cwd. A first-time AWS CLI install can overwrite a pre-existing cwd aws/ via unzip -o. Cleanup will not delete a tree it did not create.
• CloudFox still writes .txt/.json before checking returncode (unchanged; now tested).
• Codecov upload remains best-effort until a real CODECOV_TOKEN exists. This PR does not claim CI is green.
• mypy prints a pre-existing “Python 3.9 is not supported” note and still reports success.

Out of scope (unchanged)

Credential rotation, audit logging, multi-account orchestration, extensible checks, and the unmerged claude/remove-dead-code-leiPM branch.

  

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped; remaining policy and review-state checks did not require human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}