Gated real-AWS smoke test (self-termination regression guard)

[scttfrdmn]

The self-termination guarantee silently regressed once (#19: spored run → crash-loop) and was only caught by a manual live run. Add a cheap, manually-triggered CI job that re-runs the #2 validation so it can't regress unnoticed.

What it does

Mirror the live-observe harness used for #2/#19: launch one t4g.nano (us-east-1) with a short TTL + the spored-instance-profile, poll unattended, assert the instance self-terminates on its TTL, then leak-check. Hard backstop terminate if it doesn't (that's the failure signal).

Constraints (cost-safety)

• workflow_dispatch only — never on push/PR.
• Requires an OIDC role (or a scoped secret) with RunInstances/DescribeInstances/TerminateInstances + PassRole for spored-instance-profile.
• Hard TTL (≤5m) + backstop terminate + explicit leak assertion. Documented cost (<1¢).

Acceptance

• A .github/workflows/live-smoke.yml gated on workflow_dispatch.
• Reuses the EC2Provider launch path (compiled) + a small observe script.
• Fails if the instance is still running past deadline+grace, or if any spawn-ts-* instance/volume leaks.
• README/docs: how to run it, the IAM prerequisite, and the cost.

Size: medium.