STAC-25590 Publish pre-release DEBs to the tooling bucket

[LouisParkin]

The DEB publish lane assumes its OIDC role and signs the package, then gets denied s3:PutObject. stackstate-agent-3-test lives in the master account while the role lives in tooling, so the write crosses an account boundary and would need a bucket policy the bucket does not have.

StackVista/terraform-infra#89 creates a tooling-owned replacement, sts-agent-prerelease, instead of granting cross-account access to a bucket whose existing policy is what serves the public apt repository. S3 names are global, so it could not keep the old name.

STS_AWS_TEST_BUCKET_YUM and STS_AWS_TEST_BUCKET_WIN deliberately still point at the master buckets — nothing in this lane publishes to them, and that is where their content is. install.sh therefore renders a deb URL in tooling and yum/Windows URLs in master until those buckets move too.

Important

Merge only after StackVista/terraform-infra#89 is applied — the bucket has to exist first.

Validation

• zizmor clean on the changed workflow
• YAML parses
• The publish itself can only be verified by a push to the release branch after STAC-4766 aws-eks kubernetes services #88 applies

STAC-25590

[LouisParkin]

Unblocked: terraform-infra #89 applied at 11:36 UTC — sts-agent-prerelease now exists in tooling/eu-west-1, and the master-account role from #88 is destroyed.

Two things verified before marking this ready:

• Region. deb-s3 reads AWS_DEFAULT_REGION only (falling back to us-east-1), never AWS_REGION. The old bucket was us-east-1, so this was never exercised. configure-aws-credentials exports AWS_DEFAULT_REGION whenever aws-profile is unset, which it is here, so the eu-west-1 bucket resolves correctly.
• Anonymous ListBucket is now denied on the new bucket (403); the old one returns 200 and exposes every historical branch name.

Note for whoever validates the README URL: the bucket is ~2h old, so sts-agent-prerelease.s3.amazonaws.com still 307-redirects to the regional endpoint until S3 DNS propagates (up to 24h). curl -o- has no -L, so test the install one-liner after propagation, not before. Publishing itself is unaffected — the SDK is region-aware.