feat(ops): automated ephemeral stack cleanup script

[scottschreckengaust]

Summary

• Adds scripts/cleanup-ephemeral-stacks.sh — a shell script that identifies and deletes orphaned ABCA ephemeral CloudFormation stacks
• Handles stuck ENI cleanup (Lambda/AgentCore Hyperplane ENIs) before stack deletion to prevent DELETE_FAILED states
• Respects termination protection and skips stacks in active transitions
• Supports --dry-run, --max-age-hours, --prefix filter, and --force-eni options

Status

Script only — this is the operational cleanup tool from Issue #72. Still needed for full issue completion:

• EventBridge scheduled rule (Lambda or Step Functions wrapper) for automated recurring execution
• CloudWatch logging/metrics for audit trail
• CDK construct or standalone stack to deploy the scheduler
• Integration tests / dry-run CI validation

The script itself is complete and production-ready for manual use today.

Test plan

• Run with --dry-run against an account with ephemeral stacks
• Verify termination-protected stacks are never touched
• Verify ENI cleanup works for stuck VPC security groups
• Verify --max-age-hours filtering is correct

Part of #72 — this PR delivers the manual cleanup script foundation only. Full issue completion (EventBridge schedule, CloudWatch audit, CDK construct, tests) lands in a future PR.

🤖 Generated with Claude Code

[scottschreckengaust]

Revived this branch: rebased onto latest main (kept your "Update branch" merge 971b1da) and hardened the script for defense in depth (commit baaaec0).

Security/robustness review — ran shellcheck (exit 0, clean) and semgrep --config=auto (0 findings) on the result. Manual review found and fixed:

• Fail-open age gate (most important): a parse failure on CreationTime previously fell back to epoch 0, making every matching stack look billions of seconds old and eligible for deletion. Now fails closed — unparseable time → SKIP.
• Input validation: --max-age-hours is validated as a non-negative integer before arithmetic (rejects garbage/injected values).
• Blast-radius visibility: prints account ID + caller ARN (sts:GetCallerIdentity) before any mutation; hard-fails if identity can't be resolved.
• No mid-run abort: a single delete-stack failure under set -e would abort the loop and orphan later stacks — now tolerated, counted, and reported (Failed: line).
• Removed dead --force-eni flag (SC2034); annotated JMESPath --query backticks (SC2016 false positive).

Scope unchanged: still the manual script only (Part of #72). EventBridge schedule, CloudWatch audit, CDK construct, and tests are deferred to a future PR.

[scottschreckengaust]

Follow-up filed: #278 — add shellcheck to the toolchain (mise + prek hooks + CI). This PR added the first destructive shell script and surfaced that shell is the only language surface with no static-analysis gate. Out of scope for this PR (toolchain/CI change, separate governance per ADR-003); tracked separately.