…aradigmxyz#287)

* feat(tools): add read-only CloudWatch tool via iron-proxy aws_auth

Add a `cloudwatch` infra tool mirroring the AWS CloudWatch MCP's read-only
surface: log groups, filter log events, Logs Insights queries, metrics, and
alarms (boto3-backed, JSON-safe responses, lazy client so discovery needs no
credentials or network).

AWS auth rides iron-proxy's `aws_auth` transform rather than holding real
credentials in the tool process. SigV4 can't be swapped on the wire like a
bearer token, but iron-proxy re-signs: boto3 signs each request with throwaway
placeholder credentials, and iron-proxy reads the region/service from the
signature scope and re-signs with the real read-only IAM keys it resolves from
the secrets backend. The keys never enter the workload — the SigV4 analogue of
the `secrets` placeholder swap. (aws_auth landed in iron-proxy v0.40.0; Centaur
pins 0.42.0-rc.2, which includes it.)

- tool_manager: AwsAuthSecret type + parser (access_key_id/secret_access_key/
  session_token refs, allowed_regions/services, hosts)
- proxy_config: render the aws_auth transform; add to _MANAGED_TRANSFORMS
- iron-proxy base configs: allowlist x-amz-* so x-amz-target (the CloudWatch
  operation header) survives egress filtering
- cloudwatch tool: declare the aws_auth secret; sign with placeholders; region
  is the only real value (non-secret, read from env, defaults us-east-1)
- kubernetes: expose only AWS_REGION (non-secret, optional) to the tool-server
  sidecar — no AWS credentials in-process
- tests: cloudwatch client, aws_auth parser + renderer, sidecar (creds absent)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cloudwatch): allow AWS SDK signed headers through the egress filter

aws_auth re-signs CloudWatch requests with the AWS SDK v4 signer, whose
signed-headers set includes the SDK's amz-sdk-request, amz-sdk-invocation-id,
and (for CloudWatch's query-JSON protocol) x-amzn-query-mode headers.
header_allowlist runs after aws_auth and was stripping them, so AWS rebuilt
the canonical request without them and rejected every call with
InvalidSignatureException.

Allow /^amz-sdk-.*$/ and /^x-amzn-.*$/ so the signed headers reach AWS. Pairs
with the /^x-amz-.*$/ allowance already added for the SigV4 headers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* chore(iron-proxy): bump base image to 0.42.0-rc.4 for the awsauth CONNECT fix

0.42.0-rc.4 is the first release containing ironsh/iron-proxy#167, which lets
the synthetic CONNECT through the tunnel transform-policy check so aws_auth
signs the post-MITM inner request instead of rejecting the CONNECT. Required
for the CloudWatch tool's aws_auth path.

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The CloudWatch tool shipped (paradigmxyz#287) with only client.py and `_client()`, so it
works via the tool-server's `call <tool> <method>` (Python api) but is invisible
on the shim-based path (api-rs / Discord): `install_tool_shims.py` only installs
a CLI for tools that declare `[project.scripts]`, so agents there saw grafana and
vlogs but no `cloudwatch` command.

Add a Typer `cli.py` wrapping the read-only CloudWatchClient methods (log groups,
filter events, Logs Insights queries, metrics, alarms) plus the `[project.scripts]`
entry and hatch wheel packaging, mirroring the grafana/vlogs tools. Verified the
exact shim chain with `uvx --from tools/infra/cloudwatch cloudwatch --help`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>