fix: restrict Quickstart IAM user

[neebs12]

Summary

• use the operator's local AWS credentials as the privileged bootstrap authority
• restrict the stored Quickstart IAM user to image artifacts, exact-role passing, and Lambda MicroVM lifecycle
• add regression assertions preventing IAM, OIDC, bucket, and log bootstrap permissions from returning
• document the setup and credential-rotation boundary

Validation

• npm run check
• shellcheck scripts/*.sh test/scripts/*.sh
• actionlint .github/workflows/*.yml examples/*.yml
• git diff --check
• no Terraform references