refactor(kiro): migrate from aws-sdk-go v1 to aws-sdk-go-v2

[ay5399]

Summary

Migrates the kiro plugin, the only consumer of the end-of-support github.com/aws/aws-sdk-go (v1), to aws-sdk-go-v2.

• S3 and Identity Store clients are built with config.LoadDefaultConfig plus the connection's region and static credentials, as before.
• The S3API / IdentityStoreAPI interfaces and the test doubles (s3_client_test.go, s3_file_collector_test.go, discovery_test.go) now use the v2 method signatures, which take a context.Context. The S3 collector passes the subtask context. The other call sites use context.Background(), which matches v1's behaviour.
• In v2, listing results are value slices (types.Object, types.CommonPrefix) and MaxKeys is an int32.
• With no importer left, go mod tidy drops github.com/aws/aws-sdk-go (and github.com/jmespath/go-jmespath) from go.mod. The "go.mod is tidy" CI check requires this, so step 2 of [Refactor][Build] Remove the end-of-support aws-sdk-go v1 from backend/go.mod #9196 is included here.

Does this close any open issues?

Closes #9195

Part of #9196 (step 2 only). I'll remove the temporary SA1019 exclusion for plugins/kiro/ from backend/.golangci.yaml (step 3) in a follow-up PR, as planned in the issue. golangci-lint v2.14.0 already reports 0 issues for ./plugins/kiro/... with that exclusion removed locally.

Testing

Unit tests and lint: go test ./plugins/kiro/... and golangci-lint run ./plugins/kiro/... pass.

Against real AWS (the issue asked for a real-environment run). I don't have a Kiro subscription, so I placed the plugin's own tasks/testdata files (8 report CSVs, 6 chat/completion .json.gz logs) in a private S3 bucket in us-east-1, using Kiro's layout (user-report/AWSLogs/<account>/KiroLogs/user_report/<region>/<yyyy>/<mm>/<dd>/…, plus logging/…/GenerateAssistantResponse/… and GenerateCompletions/…). I then ran the same steps on main (v1) and on this branch (v2), using an IAM user limited to that bucket:

Step	v1 (main)	v2 (this PR)
POST /plugins/kiro/test and POST /connections/:id/test (incl. per-stream object counts)	OK	OK, identical response
remote-scopes (account → year → month) and search-remote-scopes	OK	identical
Collection pipeline for the 2026 scope	completed	completed
_tool_kiro_s3_file_meta / user_report / user_model_messages / chat_log / completion_log	14 / 9 / 9 / 5 / 2 rows	identical rows (excluding connection id and timestamps)

On v2, wrong credentials, a non-existent bucket and an inaccessible bucket each fail the connection test with HTTP 400 and the underlying S3 error (SignatureDoesNotMatch, request failure, AccessDenied).

Not covered:

• This run does not confirm that real Kiro exports still match the fixtures. The parsing code is unchanged by this PR, though.
• KiroIdentityClient.ResolveDisplayName is only exercised through its unit test. It does not seem to be called from any subtask yet (TaskData.IdentityClient is set but never read), so I did not set up IAM Identity Center.

@warren830, if you have a real Kiro setup, a quick run would still be welcome.

Other Information

I used Claude Code (Anthropic) to help write this change, and the commit carries a Co-Authored-By trailer as the ASF generative tooling guidance recommends. The verification above was run in my own environment and AWS account, and I have reviewed the diff.

🤖 Generated with Claude Code