real handler, sign_pdfs CodeUri, env vars, S3 IAM, fail-loud config

ctrl/seed_aws.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Uploads eth/data/*.pdf to the demo S3 bucket. Curate eth/data/ by hand
+# first — the script never reads ~/Documents and has no filter logic of its
+# own. Idempotent: aws s3 sync skips files already present at the same size.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DATA_DIR="${DATA_DIR:-$REPO_ROOT/data}"
+PREFIX="${PREFIX:-2026/04/}"
+BUCKET="${BUCKET_NAME:-eth-demo-reports-$(aws sts get-caller-identity --query Account --output text)}"
+
+if [ ! -d "$DATA_DIR" ]; then
+  echo "no such directory: $DATA_DIR" >&2
+  exit 2
+fi
+
+pdf_count=$(find "$DATA_DIR" -maxdepth 1 -name "*.pdf" | wc -l)
+if [ "$pdf_count" -eq 0 ]; then
+  echo "no .pdf files in $DATA_DIR — curate first" >&2
+  exit 2
+fi
+
+echo "syncing $pdf_count PDFs from $DATA_DIR to s3://${BUCKET}/${PREFIX}"
+aws s3 sync "$DATA_DIR" "s3://${BUCKET}/${PREFIX}" \
+  --exclude "*" --include "*.pdf"
+
+echo
+echo "done. verify with:"
+echo "  aws s3 ls s3://${BUCKET}/${PREFIX} --human-readable | tail"