feat(scripts): make tenant id more prominent and improve logging in setup scripts

[EduVencovsky]

Description of the issue

The onboarding setup scripts (scripts/) had two usability gaps in the Azure-to-AWS flow:

1. Wrong-account failure mode. The Azure-side setup takes the full IAM role ARN, but aws/setup.sh only took a role name and trusted whatever account the shell was authenticated against. Running it in the wrong account's credential context created the role and trust there, and the failure only surfaced later — silently — on the assume-role side.

2. Buried tenant ID. In the Azure VM flow, the tenant ID (the value the AWS trust step needs) was logged mid-output, after the minutes-long identity assignment, making it easy to miss and hard to copy. A mistyped VM name was also only discovered mid-run, via a raw CLI error from the identity step.

Description of changes

aws/setup.sh now also accepts CWAGENT_AWS_ROLE_ARN. When set, it validates the ARN format, fails fast when the ARN's partition or account does not match the shell's credentials (sts get-caller-identity), and derives the role name from the ARN. A CWAGENT_AWS_ROLE_NAME that disagrees with the ARN is rejected; an agreeing or default-valued one is allowed (the dispatcher always exports the default). The interactive prompt now asks for an ARN, still accepting a plain role name or empty input for the default. A warning is printed if the resulting role differs from the provided ARN (e.g. an existing EC2 instance-profile role takes precedence). Validation runs before any IAM mutation.

azure/setup.sh (azure_vm flow): the az vm show probe now fails fast with a clear message when the VM cannot be found (az's own stderr is preserved so permission or throttling errors are not misread as not-found); the tenant ID is emitted before the slow identity and install steps, so the user can start the AWS side in parallel; and it is repeated at the very end for easy copying — in the install-success message ("Agent installed on in tenant ") and above the next-steps text of the identity-only flow.

README.md: CWAGENT_AWS_ROLE_ARN documented in the common environment variable table.

No breaking changes: all existing inputs and flows behave as before when the new variable is unset.

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Tests

1. Ran make fmt and make fmt-sh
2. Ran make lint