fix(scale-up): Add ec2:TerminateInstances permission to scale-up Lambda IAM policy

[Copilot]

Description

The scale-up Lambda calls terminateRunner(instanceId) when JIT configuration fails, but lacks the ec2:TerminateInstances IAM permission. This leaves orphaned EC2 instances running when JIT setup errors occur.

Adds ec2:TerminateInstances to modules/runners/policies/lambda-scale-up.json, scoped with two condition statements matching the pattern used in the scale-down Lambda policy:

1. Scoped by ghr:Application tag (hardcoded value applied at instance creation):

{
    "Effect": "Allow",
    "Action": ["ec2:TerminateInstances"],
    "Resource": ["*"],
    "Condition": {
        "StringEquals": {
            "ec2:ResourceTag/ghr:Application": "github-action-runner"
        }
    }
}

2. Scoped by gh:environment tag (environment-specific):

{
    "Effect": "Allow",
    "Action": ["ec2:TerminateInstances"],
    "Resource": ["*"],
    "Condition": {
        "StringEquals": {
            "ec2:ResourceTag/gh:environment": "${environment}"
        }
    }
}

Also passes the environment variable (var.prefix) to the policy template in scale-up.tf.

Test Plan

• Verified the policy JSON is valid and follows the existing conditional scoping pattern from lambda-scale-down.json
• Both tag-based conditions (ghr:Application and gh:environment) match the scale-down policy exactly
• The environment template variable is passed as var.prefix, consistent with how scale-down passes it

Related Issues

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[edersonbrilhante]

@copilot @Brend-Smits it is missing

    {
      "Effect": "Allow",
      "Action": [
        "ec2:TerminateInstances",
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/gh:environment": "${environment}"
        }
      }
    }

[Brend-Smits]

@copilot have a look at the comment from #5152 (comment) and fix the problem.

[Copilot]

@copilot have a look at the comment from #5152 (comment) and fix the problem.

Added the missing ec2:TerminateInstances statement scoped by ec2:ResourceTag/gh:environment and passed the environment variable (var.prefix) to the template — matching the scale-down policy pattern exactly.

[Brend-Smits]

PR looks decent. @edersonbrilhante, what do you think?

[edersonbrilhante]

Yeap. Now should be fine.

[edersonbrilhante]

@copilot fix the conflicts

[Brend-Smits]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflict in modules/runners/scale-up.tf — kept the updated arn_runner_instance_role from main while preserving the environment variable addition.