ci: read-only AWS probe workflow

.github/workflows/aws-probe.yml

@@ -0,0 +1,41 @@
+name: AWS Probe (read-only)
+
+# Manual-only, read-only snapshot of what exists in the target AWS account.
+# Uses the same OIDC role as the CD build job. Nothing here mutates anything.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  probe:
+    name: Read account state
+    runs-on: ubuntu-latest
+    environment: build
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/webdev-deploy-build
+          aws-region: ap-southeast-1
+      - name: Identity + inventory
+        run: |
+          echo '--- caller:'
+          aws sts get-caller-identity --query Account --output text || true
+          echo '--- ECR repositories:'
+          aws ecr describe-repositories --query 'repositoryNames' --output text || true
+          echo '--- CFN stacks (ap-southeast-1):'
+          aws cloudformation list-stacks \
+            --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE CREATE_IN_PROGRESS ROLLBACK_IN_PROGRESS UPDATE_IN_PROGRESS \
+            --query 'StackSummaries[?starts_with(StackId,`arn:aws:cloudformation:ap-southeast-1`) || not_contains(StackId, `us-east-1`)].StackName' \
+            --output text || true
+          echo '--- CFN stacks (us-east-1):'
+          aws cloudformation list-stacks --region us-east-1 \
+            --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE \
+            --query 'StackSummaries[].StackName' --output text || true
+          echo '--- SSM /webdev params:'
+          aws ssm describe-parameters --parameter-filters 'Key=Name,Option=BeginsWith,Values=/webdev' --query 'ParameterConfigurations[].ParameterName' --output text || true
+          echo '--- ECS clusters:'
+          aws ecs list-clusters --query 'clusterArns' --output text || true