fix(aws): expose rate interface through shared minimum

[cristim]

Installing the AWS module from #404 alone selected a shared module version without CommitmentRateCapability. A clean consumer importing that interface failed to compile even after go mod tidy made the shared dependency direct. Raise the AWS minimum to the already published shared candidate so the normal installation path exposes the interface.

This stacked correction targets #404 and changes only the AWS dependency manifest and checksums. Runtime source, tests, EC2-only scope and Compute Holds are unchanged. Refs #349.

Verification: independent consumer compilation failed before the version correction and passed afterward; standalone AWS build and focused ladder race tests passed on macOS with Go 1.26.9 and GOWORK=off. The full prior standalone race suite covered the unchanged implementation. Two retained independent review passes cover tree ba207c320b43c40492968a6714c333f50f22763c, and all normal commit hooks passed. Published replacement-free consumer verification, committed-head review and actual CI remain merge gates.

[cristim]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-go/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: fa122f8a-10a4-4000-bdbe-7f17ff3464ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent retained adversarial review: no remaining actionable findings after two passes on head 5bef0753ec018a1a8fa43490449430d65c08448b, tree ba207c320b43c40492968a6714c333f50f22763c, against base 5b254484d5e43e8446fc8278504b71a5857e504a.

Pass 1 checked the complete two-file diff, minimum-version selection, checksums and compatibility. Pass 2 attacked the real installation path, scope and reuse: the diff changes only providers/aws/go.mod:6 and the corresponding two checksums. pkg, AWS ladder and recommendation source are byte-identical to the previously reviewed base; there are no changes to runtime, authentication, purchase/executor wiring or rate policy. The new shared version is immutable, published, and contains the optional interface. No new dependencies or abstractions are introduced.

The dependency finding is independently reproduced and closed. A fresh consumer that initially required only published AWS 5b254 and imported both ladder packages failed after go mod tidy: shared 29ad became a direct requirement but ladder.CommitmentRateCapability was undefined. My earlier consumer explicitly pinned both modules and therefore missed that installation trap. This follow-up fixes that minor packaging issue.

Fresh macOS proof with GOWORK=off, Go 1.26.9, no replacements:

• Created a separate clean consumer initially requiring only AWS v0.0.0-20261015074740-5bef0753ec01. go mod tidy naturally selected shared v0.0.0-20261015071854-5b254484d5e4; neither an explicit shared version nor a workspace supplied that selection. go list -m -json confirmed both published module versions with no replacements.
• Consumer go build ./... and go test -race -count=1 -v ./... passed. The public optional interface compiles. The actual SDK/factory loopback covers account/region exclusion, two-page weighted rate 0.7, $10 OD -> approximately $7 commitment, absent Compute Hold, missing-field Hold, malformed NaN error, scope rejection before I/O, stored-rate tranche replay and no duplicate allocation.
• Directly in the immutable published AWS module, go build ./... and go test -race -count=1 ./ladder -run 'TestCommitmentRates|TestGetCommitmentRates|TestNewFromConfig' passed. git diff --check passed. The unchanged full AWS race suite and three successful scratch mutation detections remain documented on feat(ladder): expose scoped EC2 commitment rates #404 at its base revision.

These are constructed SDK HTTP loopback fixtures, not live AWS billing acceptance. No real AWS API, purchase, deployment or execution enablement occurred. The verdict covers this exact head; actual CI, normal merge authorization, and the resulting parent #404 head still require their own checks.

[cristim]

Merge evidence for head 5bef0753ec018a1a8fa43490449430d65c08448b, tree ba207c320b43c40492968a6714c333f50f22763c, base 5b254484d5e43e8446fc8278504b71a5857e504a:

• Independent retained two-pass review and published consumer evidence: no remaining actionable findings. A clean AWS-only installation naturally selects the new shared interface; fresh macOS standalone build, focused race tests and SDK loopback consumer/replay passed.
• CI workflow 38701384810 concluded SUCCESS on this exact head. This existing workflow was dispatched because feature-targeted PRs do not trigger the main-only workflows. The separate pre-commit Actions workflow has no dispatch trigger; all normal local commit hooks passed.
• Fresh GitHub state is MERGEABLE/CLEAN, exact head/base unchanged, with no review threads or unresolved findings on this follow-up.

CodeRabbit's green status is not a completed review: it posted “Review rate limited” and separately skipped automatic review on this non-default target branch. The exact independent proof above satisfies the repository's optional-review policy.

CR waived: quota, adversarial review + local verification + green CI

This merges only into #404's feature branch. That PR's resulting head still needs its own exact-revision review and required main-target CI. No purchase, deployment or execution enablement is included.