fix(iac/federation): AWS-target CloudFormation template can't be loaded (intrinsic functions used as map keys) #1489

The AWS-target federation CloudFormation template that customers download can't be loaded by CloudFormation, on main today. cfn-lint rejects it because it uses intrinsic functions as map keys in AssumeRolePolicyDocument. A customer who downloads the AWS-target bundle and runs deploy-cfn.sh gets a template-format error and no stack.

Found in review of #1312 (rE3). #1312's new test only passes because the repo's own template evaluator accepts what CloudFormation rejects.

Suggested fix:

• Rebuild AssumeRolePolicyDocument as a single !Sub JSON string, with stricter AllowedPatterns on the inputs that feed it.
• Add cfn-lint to CI for every shipped CloudFormation template, so this can't regress unnoticed.

Acceptance:

• cfn-lint passes on every shipped template.
• A test validates the rendered AWS-target bundle with cfn-lint, not only the in-repo evaluator.

Filed by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).