Add a gated distribution workflow sample

[natesun-aws]

Description

A custom DISTRIBUTION-type image workflow that holds the built and tested AMI until an approver responds: a WaitForAction step publishes to SNS and pauses, then DistributeImage copies the AMI to a second Region, ModifyImageAttributes optionally grants launch permission, and ApplyImageConfigurations publishes each Region's AMI ID to an SSM parameter. The README covers the three distribution-stage step actions, the precedence between inline step inputs and the attached distribution configuration, per-Region step outputs, and the STOP path.

Checklist

• I deployed this sample in my own account and it created AND deleted cleanly (no leftover AMIs, snapshots, or non-empty buckets beyond what the README documents)
• The README covers prerequisites, deployment, and cleanup for what I changed
• No account IDs, ARNs from real accounts, or credentials anywhere in the change - including test data
• If this adds a sample, it's listed in the root README index

By submitting this pull request, I confirm that my contribution is made under the terms of the MIT-0 license.