feat(add-aws): skill for AWS CLI access in agent containers

[ira-at-work]

Summary

• Adds /add-aws skill: installs awscli in the agent container, wires the OneCLI CA bundle so TLS verification works through the credential proxy, mounts AWS credentials from OneCLI vault, and documents how to bypass the proxy for direct AWS endpoints.

Test plan

• Follow SKILL.md on a fresh install with an AWS credential in OneCLI vault
• Verify aws s3 ls works inside a container session
• Verify TLS succeeds (no certificate errors) through the OneCLI proxy

🤖 Generated with Claude Code

[gavrielc]

Thanks for putting this together — the structure and troubleshooting coverage are really solid.

One issue we can't work around: the NO_PROXY bypass routes AWS traffic outside the OneCLI proxy. We understand there may be individual setups where someone decides that tradeoff is acceptable for them — but it's not something we can ship as part of the project. Closing for now.

[ira-at-work]

fair enough. I will find some MCP solution or something. I don't like having the credentials seen by the agent either.