Cloud-SDK Plan #2 — PR 2: storage.s3 + step.s3_upload + aws.credentials + v1.1.0

[intel352]

Summary

• Plugin-native storage.s3 + step.s3_upload + aws.credentials (DRY module + credref registry) + in-plugin BuildAWSConfig credential helper handling all 4 source paths (static/env/profile/role_arn). Released as v1.1.0.
• Wired via the new IaCServeOptions.Modules/.Steps SDK extension (workflow v0.53.0). Single-source-of-truth ModuleProviders()/StepProviders() consumed by main.go AND the capability-parity test — structurally prevents plugin.json↔runtime drift.
• Pinned minEngineVersion: 0.53.0. Replaces locked B/C/D plan's PR 4 (which couldn't ship due to the SDK gap).

Plan #2 PR 2 of docs/plans/2026-05-15-plugin-modules-on-iac.md. After merge, v1.1.0 tag is cut, then plan #2's PR 4 (Phase B core deletion in workflow) unblocks.

Test plan

• go build ./... && go test ./... green incl. -race
• awscreds.BuildAWSConfig 7 tests (all 4 source paths + STS-injection guard + role_arn error propagation)
• credref registry race-clean (process-local mutex-guarded; t.Cleanup discipline)
• storage.s3 + step.s3_upload Provider tests (inline + credentials_ref + missing-ref → clean error)
• TestPluginJSONCapabilities_ModuleStep_Parity bidirectional set-equality (declared ↔ served)
• runtime-launch validation transcript captured (docs/runtime-validation/aws-plugin-v1.1.0.md)
• spec + quality review: zero Critical/Important

🤖 Generated with Claude Code