fix(rules): retire noisy AWS cost heuristics

[axonstone]

Summary

• Remove four AWS rules that could flag valid cost choices without usage evidence: API Gateway caching, CloudWatch metric filters, Lambda provisioned concurrency, and S3 Intelligent-Tiering.
• Remove their unused live and static datasets, public type exports, API Gateway client dependency, and tests.
• Keep the remaining 81-rule catalog, preset, documentation, and scanner expectations aligned.

These heuristics produced findings without proving that the flagged configuration would save money. Retiring them keeps default scans focused on findings backed by utilization or direct cost evidence.

Scope

• cloudburn (cli)
• @cloudburn/sdk
• @cloudburn/rules
• docs/community files

Release Notes

• Added a .changeset/*.md file for published package changes
• No published package changes in this PR

Verification

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build
• pnpm verify
• pnpm docs:test

Boundary Checks

• No engine/parser/provider logic added to @cloudburn/rules
• CLI delegates scan logic to SDK
• README/CONTRIBUTING/docs updated when behavior changed

Related Issues

None.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T19:11:25.438166Z	aada6d3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[axonstone]

Re: comment 5470669440

No action required: this is a review status notification, not a code finding.

[towardsthecloud-ci]

roborev: Combined Review (aada6d3)

No Medium, High, or Critical severity findings — both reviewers agree the code is clean.

Both reviewers confirm this is a safe, pure deletion of four low-value AWS cost heuristic rules (API Gateway caching, CloudWatch metric filters, Lambda provisioned concurrency, S3 Intelligent-Tiering) along with their datasets, hydrators, types, exports, and tests. No security-relevant or behavioral concerns identified.

---

Reviewers: 2 done | Synthesis: claude-code, 4s | Total: 2m3s

[axonstone]

Re: comment 5470685309

No action required: the combined review completed without Medium, High, or Critical findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aada6d3791

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the retired API Gateway permission from docs

After removing the API Gateway dataset, hydrator, client factory, and dependency, live discovery no longer makes GetStage calls, but docs/architecture/sdk.md:113 still tells operators that scans require apigateway:GetStage. This leaves the documented operational IAM requirements inconsistent with the implementation and can cause users to retain unnecessary access; update that permission list in the same change.

AGENTS.md reference: AGENTS.md:L23-L25

Useful? React with 👍 / 👎.

[axonstone]

Fixed in be008c8. Removed apigateway:GetStage from the live-discovery IAM permission reference so the documented access matches the remaining hydrators.