The previous commit made AWS_PROFILE default to lance-blue instead of the hardcoded jmm- name. Forcing any profile turned out to be the wrong layer: an operator may already have working credentials via SSO, an env var, an instance role, or a differently named profile. Drop the AWS_PROFILE export from all five scripts. Add a shared require_aws_credentials guard (scripts/lib/aws.sh) that runs a live sts get-caller-identity and fails with a clear message if it doesn't succeed, so an expired session is caught too, not just a missing one.