[IT-5076] Pin Spot Ocean worker AMI floor for CVE-2026-31431

[BryanFauble]

Summary

• Adds a single eks_min_ami_release_date knob in deployments/main.tf (currently 20260505) and threads it through the Spacelift wrapper and dpe-k8s-deployments stack into modules/sage-aws-k8s-node-autoscaler.
• The autoscaler module resolves the AL2023 EKS-optimized AMI via an aws_ami data source filtered on amazon-eks-node-al2023-x86_64-standard-<k8s-version>-v<date>* and pins the result onto module "ocean-aws-k8s" via ami_id.
• Spot Ocean was previously auto-selecting AMIs below the v20260505 patched release flagged by NIH STRIDES for CVE-2026-31431 (Linux kernel LPE). With this change, future CVE bumps are a one-line change to the local at the top of the stack.

Test plan

I deployed some changes to the EKS DEV cluster to use a minimum AMI version strategy. I checked into the instance provisioner that we use and verified that this is ok per the remediation path in the parent ticket EKS: Update your Node Groups to the latest AMI Release (v20260505 or later).

{
  "architecture": "x86_64",
  "creationDate": "2026-05-05T23:23:14.000Z",
  "imageId": "ami-0bb984622f47bb856",
  "imageLocation": "amazon/amazon-eks-node-al2023-x86_64-standard-1.33-v20260505",
  "imageType": "machine",
  "public": true,
  "ownerId": "602401143452",
  "platformDetails": "Linux/UNIX",
  "usageOperation": "RunInstances",
  "productCodes": [],
  "state": "available",
  "blockDeviceMappings": [
    {
      "deviceName": "/dev/xvda",
      "ebs": {
        "deleteOnTermination": true,
        "iops": 3000,
        "snapshotId": "snap-0c6977b261a80aa51",
        "volumeSize": 20,
        "volumeType": "gp3",
        "throughput": 125,
        "encrypted": false
      }
    }
  ],
  "description": "EKS-optimized Kubernetes node based on Amazon Linux 2023, (k8s: 1.33.11, containerd: 2.*)",
  "enaSupport": true,
  "hypervisor": "xen",
  "imageOwnerAlias": "amazon",
  "name": "amazon-eks-node-al2023-x86_64-standard-1.33-v20260505",
  "rootDeviceName": "/dev/xvda",
  "rootDeviceType": "ebs",
  "sriovNetSupport": "simple",
  "tags": [],
  "virtualizationType": "hvm",
  "bootMode": "uefi-preferred",
  "deprecationTime": "2028-05-05T23:23:14.000Z",
  "imdsSupport": "v2.0"
}

[thomasyu888]

🔥 LGTM! Thanks for putting this together.