Summary

Fix the AWS UAT teardown, which was a silent no-op leaking the p5.48xlarge GPU node and holding the H100 capacity reservation (cr-0cbe491320188dfa6) across every run.

Motivation / Context

The actuator image was bumped v0.2.6 → v0.4.23. Bringup was migrated to the new apply interface, but the Destroy Cluster step still called the subcommand destroy, which no longer exists in v0.4.23. The unknown command hit urfave/cli's help path and exited 0, so the if docker run … destroy; then echo "destroyed successfully" branch matched and the loop broke — nothing was ever torn down. Destruction in this image is apply with .deployment.destroy=true (the actuator's own help: "apply — Deploy or destroy infrastructure via Terraform"). The GCP UAT sibling already does it this way.

Fixes: N/A
Related: N/A

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• Other: CI — .github/workflows/uat-aws.yaml (UAT teardown)

Implementation Notes

• Set .deployment.destroy = true and invoke apply instead of the removed destroy subcommand, mirroring uat-gcp.yaml.
• Added a destroyed flag + post-loop guard so the step fails (and surfaces a ::error::) when all 3 attempts fail. docker run inside an if condition does not trip set -e, so without this a genuine destroy failure (e.g. orphaned ENIs/SGs blocking VPC deletion) would still exit 0 and re-leak silently.
• Behavior is gated by the existing skip_delete input and steps.infra.outcome != 'skipped', unchanged.

Testing

yamllint .github/workflows/uat-aws.yaml   # clean

Workflow-only change (no Go code touched). Functional validation is the next scheduled/dispatched UAT-AWS run actually destroying its cluster and releasing the reservation; the new post-loop guard means a failed teardown now turns the step red instead of passing silently.

Risk Assessment

• Low — Isolated change to one workflow's teardown step, mirrors the proven GCP path, easy to revert.

Rollout notes: Pre-existing leaked aicr-uat-* clusters from prior runs are not cleaned up by this change and must be torn down manually (apply with .deployment.destroy=true per leaked deployment.id).

Checklist

• Tests pass locally (make test with -race) — N/A, no Go changes; yamllint clean
• Linter passes (make lint) — yamllint clean
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality — N/A (CI workflow)
• I updated docs if user-facing behavior changed — N/A
• Changes follow existing patterns in the codebase (mirrors uat-gcp.yaml)
• Commits are cryptographically signed (git commit -S)