fix: spawn:version reflects the actual running spawn, and spawn:completion-file requires spawn:on-complete

[scttfrdmn]

Summary

Two independent one-line defects in pkg/aws/tags.go, per the issue:

1. spawn:version was a hardcoded literal. buildTags's "base identity (always present)" block wrote spawn:version = "0.1.0" unconditionally — every instance spawn has ever launched carries that value regardless of the actual running spawn. Nothing in the codebase could reach cmd.Version/cmd.version() from pkg/aws without an import cycle (cmd imports pkg/aws), so I added a LaunchConfig.SpawnVersion field and an aws.CallerVersion package var that cmd.Execute() sets once at startup from version() (which itself resolves via pkg/buildinfo, matching the CLI's own reported version). Client.Launch defaults launchConfig.SpawnVersion from CallerVersion when the caller didn't set it explicitly (so SDK callers like pkg/launcher that build their own LaunchConfig can still opt in). When no version is available at all, the tag is omitted, not written as a false placeholder — per the issue, absence is a better signal than a plausible-looking wrong answer.
2. spawn:completion-file was written whenever --completion-file was non-empty, but --completion-file has a non-empty flag default (/tmp/SPAWN_COMPLETE, cmd/launch_flags.go) — so a launch that only passed --ttl and nothing else got a spawn:completion-file tag with no spawn:on-complete to act on it: a watch with no action attached. Implemented the issue's preferred fix (option 1): spawn:completion-file is now only written inside the OnComplete != "" branch, so the pair is atomic. Verified pkg/provider/ec2.go:615 already defaults CompletionFile to /tmp/SPAWN_COMPLETE when OnComplete is set but no file was tagged, so a caller who did ask for completion handling is unaffected — only the false-signal-with-no-action case is fixed.

Did not implement the issue's noted-but-not-a-bug-report item (a pre-#502 role staying broken until the next launch, since ensureSporedBaselinePolicy only runs inside a launch) — the issue itself frames that as low-priority/latent and a candidate for a future spawn doctor/--iam-preflight, not something this PR's scope covers.

Test plan

• go build ./..., go vet ./..., gofmt -l . (clean)
• go test ./pkg/aws/... ./cmd/...
  • New: TestBuildTags_VersionIsNotHardcoded (3 subtests: caller-supplied version written verbatim, omitted when unset, never the old literal) and TestBuildTags_CompletionFileRequiresOnComplete (3 subtests covering the no-action, both-tags-together, and file-defaulted-by-spored cases)
  • Verified both fail against the pre-fix code (temporarily reverted just the two hunks in pkg/aws/tags.go, confirmed 4/6 subtests fail with exactly the reported symptom, restored the fix)
• golangci-lint run ./pkg/aws/... ./cmd/... — no new findings in touched files
• CHANGELOG.md updated under [Unreleased]

Fixes #515

[codecov]

Codecov Report

❌ Patch coverage is 57.14286% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/aws/client.go	0.00%	2 Missing ⚠️
cmd/root.go	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!