[jmgasper]

The first Challenge API dev deployment with v2.0.1 stopped before contacting AWS because the pinned AWS CLI opens file:///dev/stdin more than once. The subprocess pipe is exhausted on the second read, producing ParamValidation: Invalid JSON received.

Use an anonymous Linux memory file for subprocess input so each open can read the complete JSON. Credentials and request bodies remain outside command arguments and named filesystem files, and descriptors close on success and failure. The existing IAM restrictions and deployment gates are unchanged.

Validation:

• Reproduced the failure with the original pipe in the exact pinned CircleCI executor; the same offline AWS CLI request succeeds with the fix.
• All 72 tests pass inside that executor with networking disabled, including real subprocess repeated reads, descriptor cleanup, and AWS CLI parsing.
• Shell syntax and git diff checks pass.
• CI now runs the suite in the pinned executor to catch CLI compatibility regressions.

After merging, publish a new patch release and update the Challenge API suite tag/commit pin before retrying dev. The failed run pushed no candidate image and left the existing ECS service unchanged.