Fix live runner lifecycle cleanup

[neebs12]

Summary

• pass the AWS Region in a versioned, masked run-hook envelope
• allow only lambda:TerminateMicrovm as the runtime role's unscoped action
• install pinned AWS CLI 2.35.13 with the lambda-microvms service model
• assert AWS identity and the MicroVM CLI model in validation workflows
• keep bootstrap stdout machine-readable on idempotent reruns

Validation

• 55 Action tests and 17 supervisor tests
• shell syntax and ShellCheck
• AWS image 5.0 passed ready/validate hooks with overlay2 and is ACTIVE
• production Action start returned an online JIT runner
• target run 28636405901 passed checkout, ARM64, Docker, Buildx, Compose, AWS identity, and nested container checks
• exact MicroVM microvm-34a73d07-68e0-33da-878d-5a2dc2f36549 reached TERMINATED through supervisor cleanup after the same workload on image 5.0