fix(s3,elbv2,iam,cloudformation): copy-source-if-match, prober sibling-host, IAM pagination, CFN RDS port/attr + real EC2::Instance

[vieiralucas]

Cluster of confirmed correctness/compat/portability bug fixes.

S3

• CopyObject / UploadPartCopy honor x-amz-copy-source-if-match (the crate never read it). A mismatched source ETag now returns 412 PreconditionFailed instead of copying + 200. UploadPartCopy also gains the if-none-match / if-(un)modified-since copy-source preconditions it was missing. (write.rs, multipart.rs)
• GetObject/HeadObject x-amz-website-redirect-location now set via the skip-if-invalid insert_str_header helper instead of .parse().unwrap() (no longer panics on a control-char value). (read.rs)

ELBv2

• Health prober resolves i-* / ECS-bridge targets via sibling_host (detect_container_cli + HostNetworking::detect), mirroring the data plane's resolve_upstream_host. Under FAKECLOUD_IN_CONTAINER=1 probes no longer hit fakecloud's own loopback and 503 every EC2/bridge target. (prober.rs)

IAM

• ListPolicies honors OnlyAttached + PolicyUsageFilter.
• GetGroup honors Marker/MaxItems and reports IsTruncated + Marker.
• ListEntitiesForPolicy honors pagination + PathPrefix + PolicyUsageFilter.
• ListAccessKeys / ListSSHPublicKeys raise NoSuchEntity for a nonexistent user instead of an empty 200 (matching ListSigningCertificates).

CloudFormation

• RDS provisioner defaults the port from the engine (reuses RDS's default_port_for_engine; MySQL -> 3306, Oracle -> 1521, etc.) and publishes the SAME DbiResourceId stored on the record (was refabricating db-<identifier> while DescribeDBInstances returned db-<uuid>).
• AWS::EC2::Instance is now a real provisioner instead of the accept-and-ignore catch-all: creates a control-plane instance synchronously so Ref resolves to the i-... id and Fn::GetAtt PrivateIp/PublicIp/AvailabilityZone resolve, then backs it with a real container via a new EC2 cfn_provision spawn-intent (mirroring ASG), with a matching teardown intent on stack delete.

Distribution / auth

• docker.yml image smoke-test also asserts the docker CLI is present (the Lambdas on macOS #1539 Bug-4 regression vector), alongside the existing nft check.
• Dockerfile comment corrected to the pinned 29.5.3.
• main.rs IAM-enforcement-skipped startup log promoted info! -> warn! so the "skipped services allow any authorized caller" gap is as loud as the SigV4 caveat.

Tests

• e2e: S3 copy-source-if-match (412 mismatch / 200 match, no object on 412); IAM only-attached filter, GetGroup pagination, ListAccessKeys NoSuchEntity; CFN MySQL port (Endpoint.Port = 3306), DbiResourceId GetAtt == DescribeDBInstances, AWS::EC2::Instance Ref -> real i- id resolvable via DescribeInstances.
• unit: ELBv2 prober resolve_probe_host (i-*/127.0.0.1 -> sibling, real IP verbatim).

Validation

• cargo build (affected crates + binary), cargo fmt --check, clippy -D warnings (s3/elbv2/iam/cloudformation/ec2/rds), unit tests for those crates, and the 5 new e2e tests all green.

---

Summary by cubic

Fixes correctness and compatibility gaps across S3, ELBv2, IAM, and CloudFormation, and makes CloudFormation AWS::EC2::Instance create real instances backed by containers. Also improves RDS defaults and tightens distribution checks and IAM enforcement warnings.

• New Features

  • CloudFormation AWS::EC2::Instance: creates a real instance (Ref/GetAtt resolve to i-*, IPs, AZ) and then backs it with a container; matching teardown on stack delete.

• Bug Fixes

  • S3: honor x-amz-copy-source-if-match (412 on ETag mismatch); add copy-source preconditions to UploadPartCopy; avoid panic when setting x-amz-website-redirect-location.
  • ELBv2: prober resolves i-* and 127.0.0.1 targets via sibling host, fixing probes in containerized runs.
  • IAM: ListPolicies respects OnlyAttached and PolicyUsageFilter; GetGroup paginates with Marker/MaxItems; ListEntitiesForPolicy adds pagination, PathPrefix, and PolicyUsageFilter; ListAccessKeys/ListSSHPublicKeys return NoSuchEntity for missing users.
  • CloudFormation RDS: default port from engine (e.g., MySQL → 3306) and DbiResourceId matches DescribeDBInstances.
  • Distribution/auth/CI: CI smoke-test asserts both nft and docker CLIs are in the image; startup logs promote skipped IAM enforcement to warn; e2e job restarts Docker per attempt to avoid docker0 fallback and make retries independent.

^{Written for commit 7d6c4ec. Summary will update on new commits.}