carlos / platform Public

Closes four of the five things discussion #7 hit while standing up three regions in a day. The module was fine every time; everything around it was hand-rolled.

• vpc_id/subnet_id inputs, both defaulting to null so nothing changes for a deployment that has a default VPC — plus a plan-time precondition that names the fix when the region has none. This is the one that failed MID-apply, after buckets and IAM already existed.
• scope_ssm_parameter_reads (default true): an explicit Deny closing the ssm:GetParameter* on Resource: "*" that AmazonSSMManagedInstanceCore grants and that made ssm_parameter_arn bound nothing. This is the change that wants your eye before it lands — it is a live IAM change on every box at the next apply. It denies only the four parameter-read actions, so Session Manager (the only admin path to these boxes) is untouched, and it is defaulted ON because defaulting it off just moves the silence. Say if you would rather it defaulted off for a release.
• modules/region-host/README.md: the box-side runbook that used to live only in the private repo, including the AWS_REGION = deployment bucket's region rule, and the fact that there is no per-region secret.
• modules/README.md: the regions-as-data for_each pattern with the staging mesh computed instead of hand-maintained, why to pin ?ref= to a commit, and two stale pointers removed.

tofu validate clean. Nothing in this branch touches Go, so the gate here is build + tests staying green rather than anything exercising the change.

Not addressed: anything about the module's consumers, which are not in this repo.