chore(cli): bump pinned lablink-template to v0.3.1

[7174Andy]

Summary

• Bumps the pinned infrastructure template to lablink-template v0.3.1 (TEMPLATE_VERSION + TEMPLATE_SHA256).
• Adds the ssm:GetParameter permission that v0.3.1 now requires to the least-privilege policy in docs/aws-setup.md — without it, tofu plan fails for anyone following that section.
• CHANGELOG entry covering the bump and the region-move warning.

Changes Made

packages/cli/src/lablink_cli/__init__.py

• TEMPLATE_VERSION: v0.3.0 → v0.3.1
• TEMPLATE_SHA256: 97f2f96c7bbdcaeeec8bd681394883409357613bbe40f97115a7a974d61a7660

docs/aws-setup.md

• New AllocatorAmiLookup statement in the Option B custom policy: ssm:GetParameter on arn:aws:ssm:*::parameter/aws/service/canonical/*, plus an SSM row in the service table.

packages/cli/CHANGELOG.md

• [Unreleased] → Changed entry noting the app.region fix, the stock-Ubuntu-via-SSM allocator boot, the new IAM requirement, and that existing us-west-2 resources are not moved when a config names another region.

Why the docs change belongs here

v0.3.1 drops the hardcoded allocator AMI in favor of

data "aws_ssm_parameter" "allocator_ami" {
  name = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id"
}

The template's own scripts/setup.sh attaches ssm:GetParameter to the CI OIDC role, but CLI users deploy with their own credentials. The custom policy in docs/aws-setup.md had no SSM statement, so this bump would have broken every deploy that follows the least-privilege path. The managed-policy option (Option A) is unaffected — AmazonEC2FullAccess does not cover SSM either, but that path is already documented as intentionally broad; the fix targets the policy the docs actually enumerate.

Testing

• Computed the tarball SHA-256 twice from https://github.com/talmolab/lablink-template/archive/refs/tags/v0.3.1.tar.gz — stable across both fetches.

• Cleared ~/.lablink/cache/terraform/v0.3.1 and ran the real code path:

  Downloading infrastructure templates v0.3.1... done.
  v0.3.1 /Users/.../.lablink/cache/terraform/v0.3.1
  

  Checksum verification passes and all 21 template files extract (main.tf, alb.tf, backend*.hcl, user_data.sh, config/*.yaml).

• PYTHONPATH=src uv run pytest in packages/cli: 829 passed, 1 deselected.

• ruff check clean on the changed file.

Compatibility audit (why no CLI code changed)

Two items in v0.3.1's "Upgrading" notes looked like they could reach the CLI; neither does:

Release note	Impact on the CLI
db: block must be password: only (#64, #65)	The CLI's config schema exposes no db sub-keys at all, so generated configs already satisfy the strict schema.
app.region now drives the deployment (#70)	main.tf still declares region, deployment_name and environment, so deploy.py's -var= calls remain valid. AMI_MAP's comment in schema.py already documented the SSM-based allocator boot.

The dev-uses-S3-state change (#63) only affects the template's own dev environment, which the CLI does not expose.