chore(deps): bump aws-sdk, ncc, eslint, actions/checkout and rebuild dist

[kurok]

Summary

Dependency freshness pass. Verified locally with the same steps CI runs: npm ci → npm run lint → npm test → npm run package.

npm

Package	From	To	Notes
@aws-sdk/client-ec2	3.1064.0	3.1073.0	runtime, minor within v3
@vercel/ncc	0.38.4	0.44.0	dev (bundler); dist rebuilt, chunk layout unchanged
eslint	10.4.1	10.5.0	dev, lockfile only (within ^10)

dist/index.js rebuilt with ncc 0.44.0 (deterministic — a second build produces identical bytes, so verify-dist passes). The code-split chunk files (NNN.index.js) are byte-identical to before; updated the verify-dist comment in pr.yml to reference ncc 0.44.

GitHub Actions

• actions/checkout v6.0.2 → v7.0.0 (SHA-pinned 9c091bb) in package.yml and pr.yml. v7's only behavioral change blocks fork-PR checkout under pull_request_target/workflow_run — this repo uses only push/pull_request, so it's a no-op here. All other actions (cache v5.0.5, attest-build-provenance v4.1.0, setup-node v6.4.0) are already at latest.

Intentionally held back

• @actions/core 2 → 3 and @actions/github 8 → 9: both majors are ESM-only ("CommonJS consumers must use dynamic import()"). The codebase is CommonJS (require()), so adopting them requires a separate ESM migration — out of scope for a dependency bump. The ^2/^8 carets correctly hold them at the latest CJS-compatible release.

Verification

• npm run lint — clean
• npm test — 52/52 passing
• npm run package — dist rebuilt, deterministic