Verify an unmodified AWS SDK acquires and refreshes credentials from the environment alone

[alukach]

Phase 5 — API keys. Verification, not implementation — but it will find work.

Do
Confirm an unmodified AWS SDK acquires and refreshes credentials from AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN and AWS_ENDPOINT_URL_STS alone.

Done when
A plain boto3 script runs unattended across a credential expiry with no Source-specific code.

Watch

• The existing integration tests (tests/test_writes.py) POST RoleArn: "_default" by hand. That is not ARN-shaped, so the SDK's client-side ARN validation — the exact path this issue exists to prove — has never been exercised.
• get_role returns None for anything but _default until Add the ReadOnly Role alongside FullAccess #221 lands, so any non-default Role in the test fails before then.
• aws-actions/configure-aws-credentials is out of scope: it calls GetCallerIdentity, unimplemented upstream (multistore-sts: implement GetCallerIdentity (unblocks aws-actions/configure-aws-credentials) developmentseed/multistore#127).
• The refresh half needs something that rewrites the token file — Unattended refresh: exchange an API key without a browser and keep the token file fresh source-coop-cli#17.

Depends on #221, source-cooperative/source.coop#548 and source-cooperative/source-coop-cli#17.

---

Part of source-cooperative/source.coop#491.