Add Devin Outpost Mac worker (EC2 dedicated host) Terraform

[devin-ai-integration]

Summary

Terraform (+ a bootstrap script) to stand up a single Apple-silicon Mac EC2 instance and run it as a Devin Outpost worker — the worker opens an outbound-only connection to Devin Cloud, claims queued sessions for the outpost, and executes them locally on the Mac (useful for macOS/iOS builds & tests). New self-contained env under terraform/environments/devin-outpost-mac/.

What it provisions (account 599083837640, us-east-2, default VPC):

• aws_ec2_host — a Dedicated Host (required for all Mac instances)
• aws_instance — mac2-m2.metal (Apple M2, 8 vCPU / 24 GiB) on the host, latest Amazon macOS AMI (arm64_mac, resolved via data.aws_ami)
• aws_security_group — SSH in / all out; tls_private_key + aws_key_pair (PEM written locally, git-ignored)

Worker configuration (bootstrap-worker.sh, run on the Mac):

brew install ffmpeg + google-chrome  →  install Devin CLI  →  write LaunchDaemon  →  bootstrap
# /Library/LaunchDaemons/ai.devin.worker.plist runs, as ec2-user:
#   devin worker start --outpost=<name>   (env: DEVIN_OUTPOSTS_TOKEN, DEVIN_CHROME_PATH)

Non-obvious decisions worth calling out:

• Instance type = mac2-m2 (M2), not mac2 (M1). mac2.metal (the cheapest) had no capacity in any us-east-2 AZ at provisioning time (InsufficientHostCapacity). mac2-m2 is the smallest type with capacity, at ~the same price.
• LaunchDaemon, not LaunchAgent. EC2 Macs are headless by default (no logged-in Aqua session → gui/<uid> is unreachable, so a user LaunchAgent fails to bootstrap). The daemon runs as ec2-user. Caveat documented in the README: browser/computer-use and screen-recording need a logged-in window-server session (enable auto-login if required); plain build/test/repo work does not.
• Run bootstrap non-interactively so the CLI installer doesn't launch the interactive devin setup prompt — the worker authenticates via the outpost token, not a login.

⚠️ Cost / teardown caveat

AWS Mac Dedicated Hosts have a mandatory 24-hour minimum allocation — a host cannot be released (and keeps billing, mac2-m2 ≈ $0.65/hr ≈ $15.60/24h) until 24h after allocation, even if you terraform destroy sooner (the host-release step will fail until the window passes; re-run after 24h). There is no capacity-only dry-run for AllocateHosts, so probing capacity allocates real hosts — see README guidance on switching type/AZ when a host create retries indefinitely.

No secrets are committed (token/PEM are supplied at runtime / git-ignored).

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/b7a2b09a715c426fb51a8103221afd49
Requested by: @bsmitches

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring