fix(purchases): redact idempotency token in EC2 RI re-drive skip log

[cristim]

Summary

The EC2 RI idempotency-guard skip-purchase log emits the raw caller-supplied idempotency token, the same defense-in-depth leak CodeRabbit flagged on PR #652 for the five other AWS executors (RDS, ElastiCache, MemoryDB, OpenSearch, Redshift). The EC2 path predates that PR (it came in with #636) and was therefore out of scope for #652, so it still logs the token verbatim.

Current behaviour

providers/aws/services/ec2/client.go:133:

log.Printf("EC2 RI for idempotency token %s already exists (%s); skipping purchase (issue #636 re-drive)", opts.IdempotencyToken, existingID)

The full idempotency token (a stable per-execution SHA-256 hex identifier derived from execution_id:rec_index) is written to persistent logs on every re-drive of an already-purchased EC2 RI.

Steps to verify the gap

1. Trigger an EC2 RI purchase, then re-drive the same execution so the idempotency guard short-circuits.
2. Inspect the executor logs: the full 64-char token appears verbatim.

Expected behaviour

The log should emit a redacted form, consistent with the other five AWS executors after #652.

Proposed fix

Wrap the token with the existing common.MaskToken helper (added in PR #652, pkg/common/tokens.go):

log.Printf("EC2 RI for idempotency token %s already exists (%s); skipping purchase (issue #636 re-drive)", common.MaskToken(opts.IdempotencyToken), existingID)

providers/aws/services/ec2 already imports github.com/LeanerCloud/CUDly/pkg/common, so no new import is needed. One-line change plus the helper is already test-covered.

References

• Parent finding: CodeRabbit on PR feat(purchases): make AWS RDS/ElastiCache/MemoryDB/OpenSearch/Redshift idempotent (refs #641) #652 (feat(purchases): make AWS RDS/ElastiCache/MemoryDB/OpenSearch/Redshift idempotent (refs #641) #652), commit d2d5013 fixed the analogous lines in the other five services.
• Helper: pkg/common/tokens.go MaskToken (added in feat(purchases): make AWS RDS/ElastiCache/MemoryDB/OpenSearch/Redshift idempotent (refs #641) #652).
• Originating EC2 idempotency work: feat(purchases): idempotent commitment creation (ClientToken/dedupe) to enable auto-re-drive of stranded approvals #636.

Severity

Low - it's a stable derived identifier, not a credential, but it is a defense-in-depth log-hygiene gap and should match the treatment applied to the sibling executors.

[cristim]

Verification: cannot-verify-autopilot - Fix not shipped. PR #652 (merged 2026-05-22) added common.MaskToken to the 5 other AWS executors (RDS, ElastiCache, MemoryDB, OpenSearch, Redshift) but did not touch providers/aws/services/ec2/client.go. On feat/multicloud-web-frontend, the EC2 re-drive skip log at the findRIByIdempotencyToken short-circuit path still emits opts.IdempotencyToken raw: log.Printf("EC2 RI for idempotency token %s already exists (%s)...", opts.IdempotencyToken, existingID). MaskToken has never been applied to this file per git log.