docs: add provenance comments — what was replaced, why, what was removed

Each action.yml now documents:
- Original upstream repo (GitHub Actions)
- Why it was rewritten for self-hosted Gitea
- What was removed from the original
- Author and date

setup-aws/action.yml

@@ -1,3 +1,13 @@
+# Tinqs Setup AWS — replaces aws-actions/configure-aws-credentials@v4
+# Original: https://github.com/aws-actions/configure-aws-credentials (GitHub-hosted, Node.js)
+# Why rewritten: Original uses OIDC federation with GitHub's token endpoint — doesn't exist
+#   on Gitea. Our runners use IAM task roles (ECS/Fargate) or instance profiles (EC2/Lightsail),
+#   so we don't need credential configuration — just install the CLI and optionally ECR login.
+# Removed from original: OIDC, assume-role, session tokens, credential masking, region output.
+#   ECR login bundled here instead of needing separate aws-actions/amazon-ecr-login.
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup AWS'
 description: 'Install AWS CLI and optionally login to ECR'