aws_sdk_vendor: fetch aws-sdk-cpp live via ament_vendor(), drop the separate vendor repo

[Minipada]

Summary

• aws_sdk_vendor fetches aws-sdk-cpp directly from https://github.com/aws/aws-sdk-cpp.git at the pinned tag via ament_cmake_vendor_package's ament_vendor() macro (VCS_TYPE git), instead of a hand-rolled ExternalProject_Add — the same idiom zmqpp_vendor/tinyxml_vendor/yaml_cpp_vendor already use successfully on the real ROS buildfarm. No aws-sdk-cpp source is vendored anywhere.
• This supersedes aws_sdk_vendor: flattened source, no network fetch #425/PR feat(aws_sdk_vendor): flattened source, no network fetch #433's flattened-source approach, which rested on a false assumption: ros_buildfarm's own job-generation source runs binarydeb builds with docker run --net=host, and zmqpp_vendor has a real, currently-succeeding Jenkins job doing exactly this live-clone pattern.
• crt/aws-crt-cpp's submodule chain (including the unrelated CBMC formal-verification model) is now let recurse in full via ament_vendor()'s vcs import --recursive, dropping the previous hand-rolled PATCH_COMMAND exclusion hack — harmless with real network available.
• GLOBAL_HOOK is required on the ament_vendor() call: dc_bridge only ever calls find_package(AWSSDK), never find_package(aws_sdk_vendor) first, so the install prefix has to reach CMAKE_PREFIX_PATH via an environment hook, not a CMake config-extra.
• aws_sdk_vendor keeps its own separate repo (github.com/Minipada/aws_sdk_vendor, mirroring vector_vendor's split, ADR-0002's amendment) — this repo's vendor packages live in their own repos as a rule, independent of whether a given package's own content (a thin CMakeLists.txt + package.xml here, no vendored source) is large enough to justify the split on git-bloat grounds alone. ros2_data_collection.repos gains an aws_sdk_vendor entry, the same vcs import path vector_vendor already uses. vector_vendor: fetch the Vector release tarball live via checksum-pinned download, reconsider its separate repo #435 records the same decision for vector_vendor.
• The satellite repo's aws_sdk_vendor/CMakeLists.txt now also exposes an AWS_SDK_BUILD_ONLY CMake cache variable (default s3, all this workspace needs) so a downstream project can build other AWS service clients without forking the package — forwarded to aws-sdk-cpp's own -DBUILD_ONLY via a $<SEMICOLON>-escaped generator expression (verified: a plain quoted value silently mis-splits a multi-service list before it reaches ExternalProject_Add). It also gets its own CI — a Podman Containerfile build plus a prek-driven format check — mirroring this repo's own conventions.
• docs/adr/0012-aws-sdk-vendor-flattened-source.md documents the buildfarm network-access finding and both decisions (live fetch, own repo).
• tools/e2e/Containerfile, .github/workflows/ci.yaml, and tools/e2e/scripts/verify_network_isolation.sh comments updated: the network-isolation-check job is now documented as a permanent, by-design failure for aws_sdk_vendor (not a TODO pending aws_sdk_vendor: flattened source, no network fetch #425), and no longer COPYs a local aws_sdk_vendor/ directory since it now arrives via toolchain-base's existing vcs import step (alongside vector_vendor). .pre-commit-config.yaml and REUSE.toml needed no changes.
• The github.com/Minipada/aws_sdk_vendor repo (created for aws_sdk_vendor: flattened source, no network fetch #425/PR feat(aws_sdk_vendor): flattened source, no network fetch #433's now-superseded flattened-source design) is un-archived and its content replaced with the thin wrapper above — not deleted, since it's needed again.

Verification (acceptance criteria)

• colcon build --packages-select aws_sdk_vendor from scratch, fetched from the satellite repo, succeeds — ~13min, clean except one benign upstream LEGACY_BUILD CMake warning.
• Full workspace colcon build + colcon test (tools/e2e/Containerfile's workspace stage): 17 packages build, 634 tests pass, 0 failures, dc_bridge builds and links in ~15s.
• ldd against the built dc_bridge binary (after sourcing install/setup.bash) resolves every AWS SDK/CRT .so — no "not found" entries.
• tools/e2e/scripts/verify_network_isolation.sh still fails as designed: aws_sdk_vendor's build fails under --network=none (the download step errors out) while vector_vendor's succeeds — confirming this is a permanent, attributable seam, not a regression.
• The AWS_SDK_BUILD_ONLY escaping was verified in isolation (a standalone ExternalProject_Add harness) for both the default single-value case and a multi-service (s3;dynamodb) override, confirming the inner configure step receives the correct semicolon-separated list either way.
• github.com/Minipada/aws_sdk_vendor's own new CI (Podman build) verified locally against its Containerfile.
• prek run --all-files --skip build-doc passes clean in this repo, including reuse and hadolint; reuse lint passes clean in the satellite repo too.

Closes #434

🤖 Generated with Claude Code

https://claude.ai/code/session_0169YY4yK42mPfah3DbsXwmt

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.93%. Comparing base (71be58b) to head (02f72d1).

Additional details and impacted files

@@           Coverage Diff           @@
##            jazzy     #437   +/-   ##
=======================================
  Coverage   70.93%   70.93%           
=======================================
  Files         119      119           
  Lines        7401     7401           
=======================================
  Hits         5249     5249           
  Misses       2152     2152           

Flag	Coverage Δ
cpp-jazzy	70.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.