feat(aws-marketplace): gate Enterprise on the AWS Marketplace container license and add the EKS install profile - #9917

Summary

• On a Marketplace install (AWS_MARKETPLACE_LICENSE_PRODUCT_SKU set), the container entrypoint reads the buyer's AWS License Manager licenses for this product before the server loads, with ListReceivedLicenses filtered to the product SKU and the AWS Marketplace issuer fingerprint. A license that License Manager reports AVAILABLE and that carries the enterprise_license entitlement sets ENTERPRISE_ENABLED and its browser twin, so every existing Enterprise gate reads the answer unchanged
• The license is read, not checked out. A contract usually covers the deployment with one unit, so a checkout from every replica would make them compete for it, and a unit stuck after a failed check-in reads exactly like an expired license for an hour
• No license, or a check that can't reach License Manager, leaves Sim running as the open-source core. It never stops serving
• It re-checks every 15 minutes, the cadence AWS recommends for renewals, upgrades and cancellations. A definitive change (not a failed check) sends SIGTERM so Kubernetes restarts the pod in the right mode. Enterprise flags are read once at startup by the server and the browser, so a restart applies the change without rewriting any gate
• Nothing runs without the SKU env var, so other self-hosted and cloud deployments are unaffected
• New examples/values-aws-marketplace.yaml, the EKS profile the Marketplace chart ships as its defaults:
  • It runs only Sim's own images: app, realtime, migrations, and the cron image for scheduled jobs in place of curlimages/curl.
  • Bundled Postgres and Redis are off in favor of the buyer's RDS and ElastiCache, because AWS Marketplace hosts and scans every image a listing can deploy. The helm test busybox hook is off for the same reason.
  • Secrets come only from pre-created Kubernetes Secrets, never from values.
  • The ServiceAccount is annotated for IRSA.
• New examples/aws-marketplace-prerequisites.yaml, a CloudFormation template for the buyer's account:
  • RDS for PostgreSQL 17, Multi-AZ and encrypted, with the master password managed in Secrets Manager.
  • Valkey with TLS and a generated auth token.
  • The IRSA role, allowed only license-manager:ListReceivedLicenses.
• @aws-sdk/client-license-manager 3.1162.0, the same version as the other AWS clients. It goes through awsRequestHandler, so HTTPS_PROXY is honored

Type of Change

• New feature

Testing

• helm lint and helm template with the new profile, alone and with ci/default-values.yaml, the way the chart CI renders every example. Rendered images are only simstudioai/{simstudio,realtime,migrations,cron}
• aws cloudformation validate-template and cfn-lint pass. cfn-lint's only warning is the major-only EngineVersion: '17', kept on purpose so RDS picks the current minor
• bun run lint, plus check:egress-boundary, check:source-conventions, check:utils, check:file-names, check:comment-hygiene, check:explicit-any and check:boundaries. The full audits, type-check and tests run in CI
• Chart version bumped to 1.11.15 for the chart-testing version check
• The end-to-end proof comes after release: subscribe from an allowlisted account, install on EKS from the Marketplace registry, and confirm the license read turns Enterprise on

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)