feat(agent): IAM assume-role support + multi-instance parametrization

[davidf-null]

Summary

Extends the agent modules (infrastructure/aws/iam/agent and nullplatform/agent) with two capabilities:

1. IAM sts:AssumeRole support — the agent can be granted permission to assume a configurable list of IAM roles.
2. Multi-instance parametrization — names of IAM/Helm resources are now configurable, so multiple agents can coexist in the same cluster without collisions.

Changes

infrastructure/aws/iam/agent

• assume_role_arns (list(string), default []): creates a conditional sts:AssumeRole policy (count-gated) and attaches it to the agent role only when ARNs are provided. ARNs are format-validated. Covered by tests in tests/agent.tftest.hcl.
• role_name / policies_name_prefix overrides — default to the existing nullplatform-{cluster_name} / nullplatform_{cluster_name} convention, so existing consumers see no diff.
• service_account_name — the OIDC trust relationship now trusts this SA name instead of the hardcoded nullplatform-agent.

nullplatform/agent

• release_name — the helm_release name is now configurable (was hardcoded nullplatform-agent).
• service_account_name — the values template renders the serviceAccount block (create/automount/name).
• image_repository — allows overriding the agent container image repository (previously only the tag).

Compatibility

All new variables default to the previous hardcoded behavior — no diff for existing consumers (the assume-role policy and SA/repository overrides are opt-in).

Notes

• This branch also merges main up to v4.0.1 (includes the v4.0.0 breaking change feat(dns,ingress,iam)!, which does not touch the agent modules).
• The local np-api-skill.token credential was added to .gitignore (never committed).

Testing

• tofu test, tofu validate and tofu fmt pass via pre-commit hooks.
• New tests assert the assume-role policy is absent by default and created (with correct name + valid JSON) when ARNs are provided.

🤖 Generated with Claude Code