feat: add /aws-rds-health workflow

[23seriy]

Summary

• Adds /aws-rds-health — read-only RDS/Aurora diagnostics workflow
• Covers: instance/cluster detail, recent events, CloudWatch storage/IO/CPU/connection metrics, parameter group drift, replication lag (including Aurora members and global clusters), automated/manual backup state, security group posture, subnet group, CA certificate, and engine upgrade path
• Flags: public accessibility, missing encryption, disabled deletion protection, backup retention < 7 days, replication lag > 30s, storage pressure, deprecated CA cert, and slow-query logging disabled
• Generates a severity-ranked Markdown report with verdict (🟢/🟡/🔴)
• Works for both single RDS instances and Aurora clusters

Test plan

• Validate frontmatter: ./scripts/validate-repo.sh
• Run against an RDS instance: /aws-rds-health DB_IDENTIFIER=<id> REGION=<region>
• Run against an Aurora cluster identifier
• Confirm graceful degradation when jq is absent
• Confirm no credentials or passwords appear in output

🤖 Generated with Claude Code