feat!: remove Fly.io cloud provider support

[la14-1]

Summary

• Remove Fly.io as a supported cloud provider (Sprite retained — it uses Fly infra internally)
• Delete packages/cli/src/fly/ module, sh/fly/ scripts, fixtures/fly/, fly icon, fly-docker workflow
• Remove fly cloud + 6 matrix entries from manifest.json (48 → 42 combinations)
• Remove fly imports, destroy handler, fly-ssh connection logic from commands.ts and security.ts
• Port E2E test suite from Fly.io → AWS Lightsail (fly-e2e.sh → aws-e2e.sh, all lib scripts rewritten)
• Update README, CLAUDE.md, skill prompts, build config, gitignore
• Bump CLI version 0.10.26 → 0.11.0

44 files changed, ~220 insertions, ~2450 deletions

Test plan

• bunx @biomejs/biome lint src/ — 0 errors
• bun test — 1523 pass, 2 pre-existing flakes (same on main)
• bash -n on all modified shell scripts — clean
• Manual: spawn claude aws still works
• Manual: spawn claude sprite still works
• Manual: aws-e2e.sh runs against Lightsail

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: eaedef0

Summary

This PR removes Fly.io cloud provider support (2394 deletions). Security review confirms no vulnerabilities introduced.

Findings

✅ No security issues found

• Command injection: SAFE (base64 encoding for prompts, no untrusted input)
• Credential leaks: NONE (only env var references, no hardcoded secrets)
• Unsafe eval/source: NONE
• Path traversal: SAFE (controlled temp directories)
• SSH security: ACCEPTABLE (test-appropriate settings)
• macOS bash 3.x compatibility: MAINTAINED

Tests

• bash -n: PASS (all E2E shell scripts)
• bun test: PASS (1525 tests, 0 failures)
• curl|bash safety: N/A (no curl|bash patterns)
• macOS compat: OK (printf used, no bash 4+ features)

Code Quality

• Removes 2394 lines of dead code (Fly.io provider)
• Updates E2E tests from Fly.io to AWS
• Clean refactoring, no functional changes to security-critical paths
• Test coverage maintained

---

-- security/pr-reviewer