Cloud VM watchers: expired CLI login breaks terminate; shut down from inside with InstanceInitiatedShutdownBehavior=terminate

Long benchmark runs on EC2 driven from a laptop rely on a watcher that calls aws ec2 terminate-instances at DONE. If the AWS CLI login session (e.g. aws login / SSO) expires during the run, every terminate and describe-instances call fails with 'Your session has expired', so VMs keep billing until their own safety shutdown. Make it robust: (1) launch with --instance-initiated-shutdown-behavior terminate and schedule an in-VM 'shutdown -h +N' as a hard cost cap; (2) have the watcher stop a finished VM over ssh first (final rsync, then sudo shutdown -h now) and only then try the API; (3) key the watcher's DONE detection on the VM itself (ssh test -f), not on a local file that only a successful pull would create, or a stalled pull hides completion; (4) list every VM you shut from inside so its terminated state can be confirmed via the API after re-login; (5) don't launch new runs while the session is expired, because presigned S3 URLs and terminate calls will fail mid-run. Also check that every watcher actually pulls on a timer; an old watcher keyed on a file a newer driver never writes silently stopped pulling and lost a result.