Add controlled AWS validation evidence gates

[krishna310301]

Summary

• define the controlled v1.2.1 AWS validation boundary and sanitized record formats
• bind HPA summaries, Kubernetes timelines, failure events, workload content, image digests, and fixed release identity to one run
• reject inconsistent request classes, hidden check failures, duplicate events, uncorrelated scale-out, and unstable scale-in
• make Prometheus SLI, Helm test, runtime controls, and zero-resource closure explicit execution gates

Validation

• backend: 18 passed
• evidence and recovery scripts: 32 passed
• frontend: 3 passed and production build succeeded
• k6 structured smoke: 1 request, 2/2 checks, zero failures
• Helm AWS and observability lint: passed
• Terraform native validation and formatting: passed
• two-pass spec and engineering standards review: no remaining blockers

Scope

This PR adds validation tooling and runbooks. It does not claim that the paid AWS run has completed; measured artifacts will follow only after provisioning, validation, and teardown.