AWS Your Cloud node never reports in

Regression of existing AWS behaviour found by the Dev oracle run (Task 8781, report artifact 8129). Supersedes draft #8877. Reproduction (observed): app.dev.jaah.ai, Operator org, Add node › Your Cloud › connection `jaah-test-aws` (us-east-1, subnet/SG resolved), m8i.large, Ubuntu. EC2 instance i-03ea795bfa05bdb29 was created 23:19 UTC 2026-10-21; the host stayed "Waiting for the machine to start. No progress in 1 h 16 min", last_seen never set. A GCP Your Cloud node on the same CP joined in ~7 min, so bootstrap URL/apt are not the common cause. Cause candidates (unconfirmed — read the instance's system log first): - apps/api/app/aws/ec2.py:266-268 sends no `AssociatePublicIpAddress`; since migrations/versions/202610191200_drop_unmapped_legacy_columns.py the subnet alone decides a public IP. If the subnet `jaah-test-aws` resolved has no MapPublicIpOnLaunch and no NAT route, the node cannot dial the CP. Compare apps/api/app/gcp/provider.py:212 (GCP sets public_ip explicitly). - Task 8773 commits 0dab52a61 / 1edac464f ("subnet provenance across edits") changed which subnet is picked; check the resolved subnet matches the one the pre-8773 code used. - apps/api/app/clouds/aws.py:218-254 is a thin forward of user-data/subnet/SG/profile into cloud_node_launch._run_instances (cloud_node_launch.py:1104-1149). Requirements: 1. Reproduce an AWS Your Cloud launch on dev with `jaah-test-aws`, read the instance's console output (EC2 GetConsoleOutput through the connection's credential, from the API), find where bootstrap stops, and fix the cause so the node reaches online. 2. A launch whose machine never reports in shows a readable reason on the host page within 15 minutes (e.g. "No outbound internet from subnet X" or the cloud-init failure) instead of an open-ended wait. Out of scope: GCP/Azure adapters, Jaah Hosted, node groups/Spot. Done means: - On dev, a fresh AWS Your Cloud node via `jaah-test-aws` reaches online and runs a task; stop/start/change type/grow disk/delete each take effect (screenshots) — the epic's AC3.4. - A launch that cannot report in shows a readable reason within 15 minutes (screenshot or test). - Quick gate green; a unit test pins the fixed launch parameter/behaviour.

AWS Your Cloud fixed: default-VPC subnet launches now ask for a public IP (#6602); silent launches show a boot-log reason within 13 min (#6589); universe hardening (#6598). All merged and deployed to dev. Live: online in ~7 min; stop/start/type/disk/delete pass. Run-a-task deferred (needs account). Follow-up draft #8928. Memory: proposed mem-23526.