fix(sdk): harden live discovery and static scan resilience

[axonstone]

Summary

• What changed?
  • Bounded CloudWatch Logs fan-out: hydrateAwsCloudWatchLogMetricFilterCoverage issued one DescribeMetricFilters call per discovered log group in a single unbounded Promise.all. It now batches via chunkItems with a shared per-file concurrency of 10, matching the sibling stream-activity hydrator.
  • Client resilience defaults: every AWS client factory (plus the STS client) now applies a shared base config: retryMode: 'adaptive', explicit maxAttempts: 3, and request handler timeouts (5s connection / 30s request). Adaptive mode makes the SDK proactively rate-limit itself when AWS throttles; the timeouts prevent a hung socket from stalling a discovery run indefinitely (Node sockets have no default timeout). A generic test asserts these defaults on every create* factory export so future factories cannot silently miss them.
  • Malformed Terraform no longer aborts the scan: parseHcl failures were uncaught, so a single .tf file with a syntax error crashed the entire static scan. Parse failures are now treated as "not a valid Terraform file" and skipped, matching the CloudFormation parser's existing behavior for malformed templates.
• Why was this needed? In large accounts the unbounded metric-filter fan-out could fire thousands of concurrent API calls per region (throttling risk), clients had no proactive rate-limiting or timeouts, and one in-progress Terraform edit could take down a whole scan run.

Diagram

flowchart TB
    subgraph Discovery["Live discovery hardening"]
        A[Discovered log groups] -->|before: unbounded Promise.all| B[DescribeMetricFilters]
        A -->|after: chunkItems, max 10 in flight| B
        C[baseAwsClientConfig] -->|adaptive retryMode / maxAttempts 3 / 5s connect + 30s request timeouts| D[All AWS client factories + STS]
    end
    subgraph Static["Static scan hardening"]
        E[.tf file] --> F{parseHcl}
        F -->|valid| G[IaCResource entries]
        F -->|throws - before: aborts entire scan| H[crash]
        F -->|throws - after: skip file, keep scanning| I[empty result for file]
    end
    style H stroke:#f66,stroke-dasharray: 5 5

Loading

Scope

• cloudburn (cli)
• @cloudburn/sdk
• @cloudburn/rules
• docs/community files

Release Notes

• Added a .changeset/*.md file for published package changes
• No published package changes in this PR

Verification

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm verify

Boundary Checks

• No engine/parser/provider logic added to @cloudburn/rules
• CLI delegates scan logic to SDK
• README/CONTRIBUTING/docs updated when behavior changed (no user-facing behavior contract changed; failure handling only)

Related Issues

None found (gh issue list shows only #64, unrelated).