feat(aws): shared cluster in previews-shared scopes secrets per env

[BSick7]

Stacked on #27. Wires the shared mode into the modules.

aws-ec2-vault-cluster 0.2.0

• shared = data.ns_workspace.this.env_name == "previews-shared", exposed as output shared (bool).
• User-data writes SHARED_ENVS=<shared> so the nodes render the matching policies.
• Pins vault-admin ~> 0.3.0. tofu init on this module fails until vault-admin v0.3.0 is published; the tests here ran against 0.2.2 with the pin swapped locally.

aws-vault-access 0.3.0

• Reads the cluster's shared output (try(..., false), so 0.1.x clusters read as unshared).
• Passes env = <workspace env name> to the function only when shared.
• Injects VAULT_ENV, always present, empty on an unshared cluster.

Docs

README: shared cluster section under Tenant isolation, app contract for both values of VAULT_ENV, Nullstone previews.yml wiring, new envs commands. CHANGELOG 0.2.0.

Release order

1. Merge feat: shared cluster in previews-shared scopes secrets per env #27.
2. Tag and publish vault-admin v0.3.0 (feat: bind app roles to an env-scoped entity on shared clusters vault-admin#6).
3. Merge this. Bake the node AMI. Publish aws-ec2-vault-cluster 0.2.0 with --include='templates/*' and aws-vault-access 0.3.0.

[BSick7]

Folded into #27.