marketplace: EKS add-on delivery option template

[fheikens]

Part of #233 (Marketplace reach expansion). Adds an EksAddOnDeliveryOptionDetails delivery option so Signals is discoverable and installable from the Amazon EKS add-on catalog (console / aws eks create-addon / eksctl), alongside the live Helm/EKS and container-image (#234) options. Reuses the same re-hosted Marketplace-ECR image and chart — one artifact set, installed three ways. Additive; existing options untouched.

What's here (in-repo artifacts)

• specifications/marketplace-eks-addon-delivery.md (ACTIVE) + .acceptance.md — integration-mapping spec. Load-bearing points:
  • INV-EAO-01 one artifact set: the add-on's ContainerImages/HelmChartUri must be the same digest as the Helm option's.
  • INV-EAO-02 behavioral parity: it's the same chart, console-installed — same read-only collector.
  • R-EAO-03 / INV-EAO-03 immutable identity: AddOnName/AddOnType/Namespace are fixed across all future versions (INCOMPATIBLE_ADDON_* if changed).
  • R-EAO-06 the add-on option is not auto-Public (unlike Helm/container) — publishing it is a separate visibility step.
• docs/marketplace/catalog-api/05-add-eks-addon-delivery.json — additive template. AddOnName: signals, AddOnType: observability, Namespace: signals, SupportedArchitectures: [amd64, arm64], CompatibleKubernetesVersions parameterized via K8S_VERSIONS.
• scripts/marketplace-changeset.sh — new AddOnType preflight guard (AWS only validates post-submit, and it's immutable — costly to typo); step-05 usage header.
• docs/marketplace/catalog-api/README.md — EKS add-on row with the immutability + visibility notes.

Decisions (confirmed)

• AddOnType: observability — confirmed with product owner. Immutable, so locked deliberately; Signals is diagnostic collection, which is the modern EKS observability framing.
• AddOnName/Namespace = signals (matches the chart's release namespace).
• CompatibleKubernetesVersions is operator-supplied at submit (K8S_VERSIONS) so we declare only tested EKS versions — a stale hardcoded default would silently over-claim.

Validation

• shellcheck clean; template renders to valid JSON, 0 leftover ${}, 0 non-ASCII; AddOnType guard passes valid and catches an injected bad value; trivy fs --scanners secret . clean.

Not done by merging this

The AWS AddDeliveryOptions submission + the live EKS add-on install smoke (TC-EAO-05) are a gated operator step (one review round; add-on visibility is a separate publish). So this is Refs #236, not closes.

Refs #236, #233