The account is shared with didbot, and nothing else is: state goes to the account's bucket under its own key, the zone permadeath-aws-org made is read rather than created, the provider is guarded to the one account and pinned to us-east-1 because the organisation allows nothing else, and the instance may pull only its own three images. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Change-Id: I11a565059d49aa82b5877e168963fb354c1ef119