Track ~/.aws/config (profiles only, never credentials) as a copied
config: setup.sh restores it, update.fish refreshes it. Document the
S3 state backend setup for resoftware-iac in the README, including
the config/credentials profile-header gotcha behind "failed to get
shared config profile".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
