feat(si): Implement Multi-File Context System for AI Coding Tools

The System Initiative assistant context was defined in a single monolithic SI_Agent_Context.md.tmpl file (~27KB) that was used identically across all AI coding tools (Claude Code, Codex, Cursor, OpenCode.ai). This approach:

- Loaded entire context into memory at startup regardless of what was needed
- Couldn't leverage each tool's native multi-file capabilities
- Made maintenance difficult as provider documentation grew
- Provided no way to selectively access provider-specific documentation

We now implemented a modular template system that splits provider documentation into separate files and uses each tool's optimal loading strategy for efficient, on-demand context access.

### Modular Template Structure

**Created provider-specific templates in data/templates/providers/:**
- common.md.tmpl - Core System Initiative concepts (change sets, MCP server)
- aws.md.tmpl - AWS CloudFormation schema documentation
- azure.md.tmpl - Microsoft Azure ARM resource documentation
- hetzner.md.tmpl - Hetzner Cloud schema documentation
- digitalocean.md.tmpl - DigitalOcean resource documentation
- google.md.tmpl - Google Cloud resource documentation

### Tool-Specific Implementations

**Claude Code - Skills with Progressive Disclosure:**
- CLAUDE.md contains common content + skill usage instructions
- Generates 5 provider skills in .claude/skills/{provider}-infrastructure/SKILL.md
- Skills auto-discovered and invoked based on query context
- Skills use 3-level progressive disclosure: metadata → instructions → resources
- Includes proper YAML frontmatter with allowed-tools matching Claude settings

**Codex - On-Demand Read Tool:**
- AGENTS.md contains common content + instructions to use Read tool for provider docs
- Creates docs/providers/{provider}.md for each provider (5 files)
- Codex dynamically reads provider docs only when answering provider-specific questions
- No global configuration required, works out of the box
- Supports multi-provider workflows without context window bloat

**Cursor - On-Demand Read Tool:**
- .cursorrules contains common content + instructions to use Read tool
- Shares docs/providers/ directory with Codex (5 provider files)
- Cursor reads provider docs on-demand when answering provider questions
- Efficient lazy loading prevents unnecessary context consumption

**OpenCode - On-Demand Read Tool:**
- Auto-loads AGENTS.md (shared with Codex)
- Shares docs/providers/ directory with Codex and Cursor
- Reads provider docs on-demand using Read tool
- Works automatically without additional configuration

### Benefits

✅ Efficient context usage - Tools load only what they need, when they need it
✅ Modular maintenance - Update one provider file, all tools benefit
✅ File sharing - Codex, Cursor, and OpenCode share AGENTS.md and docs/providers/
✅ No duplication - Single source templates, tool-specific generation strategies
✅ Native capabilities - Each tool uses its optimal loading mechanism
✅ Scalable - Add new providers by creating one template file
✅ Multi-provider support - All tools can access multiple providers in one session

Author: stack72

bin/si/data/templates/SI_Agent_Context.md.tmpl

@@ -0,0 +1,261 @@
+# AWS Components
+
+System Initiative uses the CloudFormation schema through the Cloud Control
+service.
+
+When you create AWS Components for the user, you should always create the
+following subscriptions if the schema allows it:
+
+- /domain/extra/Region: should subscribe to a Region components /domain/region.
+- /secrets/AWS Credential: should subscribe to an AWS Credential components
+  /secrets/AWS Credential
+
+If no Region or AWS Credential component is present, you should tell the user to
+create them first.
+
+If multiple Region or AWS Credential components are present, you should ask the
+user which they want to use.
+
+If you are working with AWS IAM components:
+
+- Use the schema-attributes-documentation tool to understand every field.
+- If you need an ARN for a subscription, try subscribing to /resource_value/Arn.
+
+## 🔍 Schema Search Case Sensitivity
+
+When checking for available AWS schemas (for example,
+`AWS::VpcLattice::Service`), **System Initiative's schema search is
+case-sensitive**. If a search for a schema name returns no results, try
+alternate casing variations, such as:
+
+- `AWS::VpcLattice::Service`
+- `AWS::VPCLattice::Service`
+- `AWS::VPCLATTICE::Service`
+
+Searching across multiple case variations ensures accurate discovery of AWS
+CloudFormation resources. For best results, always include all plausible casing
+patterns when verifying schema availability.
+
+## Using AWS Account Component with String Templates for IAM Policies
+
+When creating IAM policies that require dynamic values like AWS Account ID, use
+the **AWS Account** component with **String Template** components:
+
+**Pattern:**
+
+1. Create an **AWS Account** component to retrieve account information
+2. Create **String Template** components to build dynamic ARNs or policy
+   documents
+3. Subscribe IAM components to the String Template's rendered output
+
+**Example: GitHub OIDC Trust Policy**
+
+1. Create AWS Account component:
+
+   ```
+   Component: aws-account-info (AWS Account)
+   Attributes:
+     /secrets/AWS Credential: {$source: {component: "credential-id", path: "/secrets/AWS Credential"}}
+   ```
+
+2. Create String Template for OIDC Provider ARN:
+
+   ```
+   Component: github-oidc-provider-arn (String Template)
+   Attributes:
+     /domain/Template: "arn:aws:iam::<%= AccountId %>:oidc-provider/token.actions.githubusercontent.com"
+     /domain/Variables/AccountId: {$source: {component: "aws-account-info-id", path: "/domain/AccountData/Account"}}
+   ```
+
+3. Create String Template for trust policy document:
+
+   ```
+   Component: github-trust-policy (String Template)
+   Attributes:
+     /domain/Template: "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"Federated\": \"<%= OidcProviderArn %>\"}, \"Action\": \"sts:AssumeRoleWithWebIdentity\", \"Condition\": {\"StringLike\": {\"token.actions.githubusercontent.com:sub\": \"repo:orgname/reponame:ref:refs/heads/main\"}}}]}"
+     /domain/Variables/OidcProviderArn: {$source: {component: "github-oidc-provider-arn-id", path: "/domain/Rendered/Value"}}
+   ```
+
+4. Use in IAM Role:
+   ```
+   Component: github-actions-role (AWS::IAM::Role)
+   Attributes:
+     /domain/AssumeRolePolicyDocument: {$source: {component: "github-trust-policy-id", path: "/domain/Rendered/Value"}}
+   ```
+
+**Available AWS Account Attributes:**
+
+- `/domain/AccountData/Account` - AWS Account ID (12 digits)
+- `/domain/AccountData/Arn` - ARN of the caller identity
+- `/domain/AccountData/UserId` - Unique identifier of the caller
+
+**String Template Usage:**
+
+- Use `<%= VariableName %>` to insert variable values
+- Access rendered output via `/domain/Rendered/Value`
+- Can nest String Templates (subscribe one template to another's output)
+- Use proper JSON escaping in policy documents
+
+## AWS IAM Component Creation Guide
+
+When creating and configuring AWS IAM components (roles, users, policies, etc.)
+for specific use cases, follow these guidelines:
+
+### Available AWS IAM Schemas
+
+These are the ONLY IAM schemas available in System Initiative:
+
+- **AWS::IAM::Role** - For service roles and cross-account access
+- **AWS::IAM::User** - For human users or programmatic access
+- **AWS::IAM::Group** - For grouping users with similar permissions
+- **AWS::IAM::ManagedPolicy** - For reusable permission policies
+- **AWS::IAM::RolePolicy** - For attaching managed policies to roles (by ARN)
+- **AWS::IAM::UserPolicy** - For attaching managed policies to users (by ARN)
+- **AWS::IAM::InstanceProfile** - For EC2 instance roles
+
+**IMPORTANT**: These seven schemas are the ONLY IAM-related schemas available.
+Do not attempt to create or reference any other IAM schemas as they do not exist
+in this system.
+
+**Key Distinction - AWS::IAM::RolePolicy in System Initiative:**
+
+- In System Initiative, **AWS::IAM::RolePolicy** is used to **attach existing
+  managed policies** to roles by their ARN
+- This is different from AWS CloudFormation where RolePolicy is for inline
+  policies
+- To attach a managed policy: Create AWS::IAM::RolePolicy with
+  `/domain/PolicyArn` subscribing to the managed policy's `/resource_value/Arn`
+- AWS::IAM::RolePolicy does **NOT** have `/domain/extra/Region` - only
+  `/domain/RoleName`, `/domain/PolicyArn`, and `/secrets/AWS Credential`
+
+**Analyze Requirements**
+
+- Based on the use case, determine which IAM components are needed
+- Consider security best practices (principle of least privilege)
+- Plan the relationships between components
+
+**Query Schema Actions and Create Core IAM Components**
+
+- **FIRST**: Use schema query tools to discover available actions for your
+  target schema
+- Start with the primary component (usually Role or User)
+- Use component-create tool with appropriate schema
+- Configure all required properties with proper values
+- Note: Action names are System Initiative-specific, not standard AWS API names
+
+**Configure Policies (CRITICAL - JSON Formatting)**
+
+**Policy Configuration Rules:**
+
+- ALWAYS provide complete, valid JSON as a string
+- Use proper JSON escaping for quotes
+- Include Version field ("2012-10-17")
+- Follow AWS policy syntax exactly
+
+**Good Example:**
+
+```
+Trust policy for EC2 role:
+"{
+  \"Version\": \"2012-10-17\",
+  \"Statement\": [{
+    \"Effect\": \"Allow\",
+    \"Principal\": { \"Service\": \"ec2.amazonaws.com\" },
+    \"Action\": \"sts:AssumeRole\"
+  }]
+}"
+```
+
+**Bad Example:**
+
+```
+[object Object]
+"{{ trust_policy }}"
+undefined
+```
+
+6. **Create Supporting Components**
+   - Add any required ManagedPolicies with specific permissions
+   - Create InstanceProfile if needed for EC2 roles
+
+7. **Configure Relationships and Attach Policies**
+   - Use component-update to set attribute subscriptions
+   - Link roles to instance profiles
+   - **To attach a managed policy to a role:**
+     1. Create AWS::IAM::ManagedPolicy with the policy document
+     2. Create AWS::IAM::RolePolicy component
+     3. Set `/domain/RoleName` to subscribe to the role's `/domain/RoleName`
+     4. Set `/domain/PolicyArn` to subscribe to the managed policy's
+        `/resource_value/Arn`
+     5. Set `/secrets/AWS Credential` subscription
+   - Example:
+     ```
+     /domain/RoleName: {$source: {component: "role-id", path: "/domain/RoleName"}}
+     /domain/PolicyArn: {$source: {component: "policy-id", path: "/resource_value/Arn"}}
+     /secrets/AWS Credential: {$source: {component: "credential-id", path: "/secrets/AWS Credential"}}
+     ```
+
+8. **Validate Configuration and Check Qualifications**
+   - Review all components for completeness
+   - Ensure JSON policies are properly formatted
+   - Verify relationships are correctly established
+   - **CRITICAL**: Query the qualifications on each schema to check for
+     validation errors before applying the change set
+   - Address any qualification failures before proceeding
+
+## Planning Framework
+
+Before creating components, analyze:
+
+- What AWS services need to be accessed?
+- Is this for human users or service roles?
+- What's the minimum set of permissions required?
+- Are there existing policies that can be reused?
+- What security constraints should be applied?
+
+##### Common Policy Templates
+
+**S3 Read-Only Access Policy:**
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:GetObject", "s3:ListBucket"],
+      "Resource": ["arn:aws:s3:::bucket-name/*", "arn:aws:s3:::bucket-name"]
+    }
+  ]
+}
+```
+
+**Lambda Execution Role Trust Policy:**
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "lambda.amazonaws.com" },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+```
+
+**EC2 Instance Role Trust Policy:**
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": { "Service": "ec2.amazonaws.com" },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+```