[sjmiller609]

Summary

• Add one small shared SSM credential action for CI and Ansible. It masks values, rejects invalid/unsecured parameter data, and does not replace caller AWS credentials.
• Switch public image publication/e2e pulls from GitHub secrets to SSM through the existing browser-image role.
• Run credential-bearing builds on trusted branch pushes/dispatches, not public PR merge refs. Same-repository branches get the full build/e2e path; fork PRs remain credential-free with unit tests.

Prerequisites

The SSM read permissions must deploy and the production SecureString /kernel/dockerhub/credentials must be populated first. Other consumers pin the shared action commit from this PR.

Validation

• Workflow lint passed
• Synthetic helper checks: successful delivery/masking, empty/multiline credential rejection, and rejection of non-SecureString parameters
• No new test framework or runtime image changes

Live SSM reads, image builds, and e2e tests were not run locally.