[codex] Harden pre-merge deployment readiness

[DannyDesert]

Summary

• add a public-release readiness regression test that blocks Troy-specific AWS/Discord/private-network IDs in public deploy/docs/prompt surfaces
• remove active Strategist Builder/Deployer directive publications and update the objective workflow examples to route through Architect/AO-era ownership
• make AO a first-class AWS Terraform service with private Cloud Map service discovery, Core -> AO URL wiring, AO -> Core callback URL wiring, AO storage/concurrency config, and fail-fast GitHub/AO auth checks
• scrub deployment helper docs/scripts and Terraform comments/defaults so the product does not publish private deployment IDs
• fix Terraform validation blockers in Secrets Manager for_each handling and S3 lifecycle configuration

Coverage against existing PRs

• PR [codex] harden local AO install path #183 already covers local compose/CLI AO install defaults; this PR covers the AWS Terraform deploy path and public-release leakage checks.
• PR [codex] fail fast on config wiring drift #184 covers broader config wiring drift; this PR only removes the remaining active Strategist Builder/Deployer publications and adds a focused regression guard.
• PR [codex] fix Socket security workflow #185 is a Socket workflow fix and is not duplicated here.
• PR [codex] Add GitHub readiness doctor checks #186 covers GitHub readiness doctor checks; this PR adds AWS deploy-time GitHub/AO auth requirements.
• PR [codex] Harden dynamic repo registration #187 covers dynamic repo registration; this PR only passes GitHub/AO repo identity through AWS deployment config.

Verification

• npx vitest run packages/core/tests/public-release-readiness.test.ts
• npm run validate-configs --workspace=packages/core
• terraform -chdir=deploy/aws validate
• npm run typecheck
• npm test
• npm run build

Notes

• terraform validate proves syntax/module wiring. The new GitHub/AO check blocks are plan-time guardrails and require real variable values during an AWS plan/apply.
• The full test suite currently emits an existing Vitest warning about a nested vi.mock in packages/core/tests/discord-executor.test.ts; tests still pass.