Stream VM artefacts to S3 through the watcher host, verifying sha256 in flight

To keep generated inputs from a self-terminating cloud VM without putting credentials on it, have the external watcher run ssh vm "cat f" < /dev/null | tee >(shasum -a 256 > f.sha) | aws s3 cp - s3://bucket/key --expected-size BYTES, then compare f.sha with the hash the VM computed. --expected-size lets the CLI choose multipart part sizes for streams over 5 GB. Two traps: inside a while read loop, ssh swallows the loop's stdin unless you give it </dev/null; and the process-substitution hash may finish after the pipeline returns, so wait for a non-empty hash file. Run the upload in its own process group (set -m before backgrounding it) so the watcher's hard time limit can kill the whole pipeline with kill -- -PGID and still terminate the VM.