rtabench/jsonbench: remove personal key defaults and label account-specific values

[SferaDev]

Follow-up flagged in #40: that PR hardened clickbench/'s EC2 harness; this applies the same conventions to rtabench/ and jsonbench/.

What changed

Makefiles (rtabench/Makefile, jsonbench/Makefile)

• Dropped the personal EC2_KEY ?= ~/.ssh/tsg.pem default. Same convention as clickbench: pass KEY_NAME=<ec2-key-pair> (derives ~/.ssh/<key>.pem) or an explicit EC2_KEY=<path>. The $(error ...) is lazy — it only fires on targets that actually ssh/rsync, so launch-ec2, destroy-ec2, report, and fetch-competitors keep working keyless.
• launch-ec2 forwards KEY_NAME to launch-ec2.sh.
• AWS_PROFILE ?= management labeled as a Xata account default (env-overridable).
• jsonbench only: replaced the personal JSONBENCH_DIR ?= /Users/tsg/src/JSONBench default with the sibling-checkout convention already used by CLICKBENCH_DIR/RTABENCH_DIR ($(CURDIR)/../../../JSONBench, env-overridable). AGENTS.md updated to match.

Launch scripts (rtabench/launch-ec2.sh, jsonbench/launch-ec2.sh)

These are copies of clickbench's script (per-bench NAME/INSTANCE_TYPE/VOLUME_SIZE), not a shared file, so the #40 fixes are mirrored into each:

• No KEY_NAME=tsg / ~/.ssh/tsg.pem defaults — KEY_NAME is required (checked before any AWS call on the launch path; not required for --terminate-only), KEY_FILE derived/overridable.
• PROFILE/REGION/AMI/SUBNET/SG moved into a labeled "Xata account defaults" block, all env-overridable; INSTANCE_TYPE/VOLUME_SIZE/NAME env-overridable too.
• --region on every aws call instead of relying on the profile's default region.
• Hardcoded serial-console root passwords removed. clickbench: EC2 launch configuration comes from the environment #40's review noted these two had no hardcoded passwords, but they did (Rt4b3nch!s3rial#2026, Jb3nch!s3rial#2026); replaced with a random per-launch password, printed at the end — same mechanism as clickbench.
• Cloud-init wait loop now fails loudly (clear error + inspect/teardown hints + the serial password) instead of reporting a half-initialized box as ready.

Misc

• rtabench/create.sql: scrubbed a personal absolute path (/Users/tsg/src/rtabench/...) from a comment.
• No IPs or instance ids were found checked in; rtabench/.env / jsonbench/.env are gitignored and untouched.

Deliberately NOT changed

These launch scripts keep their documented replace semantics (launching terminates an existing same-name instance). clickbench's abort-on-existing behavior predates #40 and wasn't part of its diff, so changing rtabench/jsonbench to match is left as a separate decision — worth considering given the shared-account concern #40 documents.

Testing

• bash -n on both launch scripts.
• Keyless bash launch-ec2.sh exits 1 with a clear KEY_NAME error before any AWS call (both dirs); unknown options rejected.
• make -n dry-runs in both dirs: keyless psql EC2=... fails with the EC2_KEY error; KEY_NAME=mykey derives ssh -i ~/.ssh/mykey.pem; explicit EC2_KEY=/tmp/other.pem is honored; launch-ec2 KEY_NAME=mykey forwards the env; destroy-ec2 and rtabench report expand without requiring a key. Documented workflows (make -C rtabench query EC2=<ip> Q=17, make -C jsonbench query EC2=<ip> Q=2) unchanged given a key.