ci(aws): deploy blocked until the ci-cd-permissions policy is applied #1791

Problem

The platform AWS deploy has failed since 1cd4e8eb (#1090). Terraform Apply returns 403 UnauthorizedOperation on ec2:CreateNetworkInterface for module.networking.aws_network_interface.fck_nat. Failing runs: 42067955423, 42073138219 and 42074290067.

Cause

The grant is on main (terraform/environments/aws/ci-cd-permissions/policy_networking.tf:42, from #1090), but the deploy role's policies live in the human-applied bootstrap root terraform/environments/aws/ci-cd-permissions. That root hasn't been applied since #1090 merged, so the live cudly-deploy-networking policy lacks the action.

Fix (owner action, not CI)

Apply terraform/environments/aws/ci-cd-permissions from current main with IAM-write credentials.

• Expected plan: only in-place updates of aws_iam_policy.networking, plus data and compute if fix(iam): drain remaining deploy-role grant gaps and pin them with tests #1782 isn't applied yet. Nothing added or destroyed.
• Stop on any other change, especially an assume_role_policy diff, which would mean fix(iac): key AWS and Azure CI/CD trust on immutable GitHub ids #1751's trust change isn't live. Review that against fix(iac): key AWS and Azure CI/CD trust on immutable GitHub ids #1751 first.

Then re-run the failed dev deploy and close this issue, citing the green run.

Deploys are blocked until this is applied.