ci: bump version to 0.5.99 [skip ci]

ci: bump version to 0.5.98 [skip ci]

ci: bump version to 0.5.97 [skip ci]

ci: bump version to 0.5.96 [skip ci]

ci: bump version to 0.5.95 [skip ci]

fix: unbound OPTION_ARGS with set -u on empty arrays

Bash set -u treats empty array expansion as unbound variable on
some versions. Use ${arr[@]+"${arr[@]}"} pattern for safe
expansion of potentially empty arrays.

feat: bootstrap wait, SSM session doc, plugin cache, CloudShell workdir

Closes 4 critical v1 parity gaps:

1. BOOTSTRAP WAIT: After terraform apply, polls SSM parameters
   /loki/setup-status and /loki/setup-step for up to 10 minutes.
   Shows live progress in TUI log. On failure, fetches error details.
   On success, marks instance_health as 'ready'.

2. SSM SESSION DOCUMENT: Creates 'Loki-Session' SSM document that
   starts sessions as ec2-user with bash login shell. Post-install
   screen includes --document-name in the SSM command when available.

3. TF_PLUGIN_CACHE_DIR: Sets /tmp/terraform-plugin-cache before
   terraform init to avoid re-downloading ~500MB of providers.

4. CLOUDSHELL WORKDIR: Checks available disk space before init.
   If <600MB available on CloudShell, copies terraform workdir to
   /tmp and continues from there (matching v1 behavior).

Also: added env field to CommandSpec for per-command environment
variables. Updated CFN adapter for compatibility.

fix: address Codex review — 6 fixes for v2 installer

Based on full review of rc11..rc19 changes:

1. ENVIRONMENT NAME PERSISTENCE: Read from terraform state first,
   then .loki-env file, then generate new suffix. Prevents destroying
   old resources on reinstall from same checkout.

2. PACK/PROFILE SELECTION: PacksLoaded and ProfilesLoaded no longer
   auto-chain to the next action. They set the cursor on the default
   and render the screen, so user can see and change the selection
   before pressing Enter.

3. UTF-8 SAFE TRUNCATION: Deploy screen log truncation now uses
   chars().take() instead of byte slicing to avoid panics on
   multibyte characters.

4. ARTIFACT LOG GARBLING: ArtifactRecorded values now have newlines
   collapsed to spaces before display. Strip \r from terraform output.

5. BEDROCK FORM: Reverted enable_satellite_services to true (security
   services should run on first install). Instead, gated bedrock form
   invoke on request_quota_increases == true (defaults to false).

6. STACK NAME IN POST-INSTALL: Record environment_name as stack_name
   artifact so post-install screen shows the actual deployed name.

fix: align admin_setup_basic count with satellite gate

admin_setup_basic policy attachment was gated on profile_name only,
but the role it references requires enable_satellite_services too.
When satellite services are disabled (new default), terraform plan
failed with 'Invalid index' on the role reference.

fix: post-install shows SSM (not SSH), disable bedrock form by defaul…

…t, fix log wrapping

1. Post-install 'What to do next' now shows:
   aws ssm start-session --target <instance-id> --region <region>
   instead of ssh command (matches v1 installer behavior)

2. enable_satellite_services defaults to false — bedrock form Lambda
   and security enablement Lambda won't run unless explicitly enabled.
   First-time installs shouldn't submit forms by default.

3. Deploy screen log lines now truncate to fit the actual right-pane
   width instead of a hardcoded 120 chars (fixes jumbled text in
   narrow terminals like CloudShell).