Add per-minor Aurora MySQL EOL cycles to endoflife override

[Kiran01bm]

Description of changes

Aurora MySQL 3.x clusters currently classify GREEN because the amazon-aurora-mysql override only carries major cycles, and upstream endoflife.date publishes the same major-only data (cycle 3 → EOL 2028-04-30). AWS ends standard support per minor version, so 3.04.2 prefix-matches cycle 3 and is never flagged even though 3.04 ends standard support on 2026-10-31.

• deploy/endoflife-override/api/amazon-aurora-mysql.json: add per-minor cycles from the AWS release calendar: 3.04 (LTS, 2026-10-31), 3.05/3.06/3.07 (2025-08-31, from an archived copy of the calendar), 3.08/3.09 (2026-08-31), 3.10 (LTS, 2028-04-30), 3.11/3.12/3.13, 8.4.7/8.4.8, 2.11/2.12 (extended support to 2029-06-30). Cycle 2 extended support corrected to 2029-06-30 per the current calendar.
• deploy/endoflife-override/manifest.json: update the aurora entry's reason and source_url (the old "pending upstream inclusion" reason is stale — upstream merged, but major-only), bump reviewed_on/review_due_on.
• deploy/endoflife-override/aurora_mysql_test.go: new test that loads the override through the real endoflife.NewProvider and asserts the version→cycle mapping and dates (3.04.2, 3.06.0, 3.08.2, 3.10.1, 8.4.7, 2.11.5, fallback 3.99.0→3). It fails against the previous JSON.
• deploy/endoflife-override/manifest_test.go: date-sensitive cases now derive from the manifest's reviewed_on/review_due_on instead of hard-coded 2026-08 dates, so future review bumps don't break them.

No provider or policy code changes; the longest-prefix cycle match in pkg/eol/endoflife already resolves 3.04.2 → 3.04 once the cycle exists.

Related issues

• Upstream fix: [amazon-aurora-mysql] Add minor version release cycles endoflife-date/endoflife.date#11203 adds the same minor cycles to the amazon-aurora-mysql product (following the amazon-rds-mysql model: major cycles kept, one cycle per minor with eoas = minor end of standard support, eol/eoes inherited from the major, plus a release_table method that scrapes the minor-version calendar). Once that merges, this override can be removed and the manifest entry dropped. Note upstream expresses the minor date as eoas/support, not eol, so the adapter will surface it as standardEnd rather than the terminal date — worth checking the policy weighting before removing the override.
• No tracking issue; raised from Afterpay Aurora 3.04 clusters (28 in prod) reaching end of standard support on 2026-10-31 with no version-guard finding filed.
• Question for owners: the Helm chart ships extraContainers: [] and EOL_BASE_URL defaults to https://endoflife.date/api. Does the deployed worker run the override nginx sidecar? If not, this file is inert in production and the same fix has to be applied where the deployment values live.
• Follow-up (not in this PR): a provider backed by RDS DescribeDBEngineVersions / DescribeDBMajorEngineVersions so Aurora lifecycle dates are not hand-maintained.

Testing performed

• go test -race ./deploy/endoflife-override/ ./pkg/eol/... ./pkg/policy/... — pass.
• go vet ./deploy/endoflife-override/, gofmt -l deploy/ — clean.
• make lint fails on clean main with can't load config: 'output.formats' expected a map, got 'slice' (golangci-lint config/version mismatch); not addressed here.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[rileyepruitt]

🤖 Reviewed by Riley’s AI agent against the PR description at 6534bf8. No P0 or P1 findings. Verified provider-to-policy classification and passed the full race-enabled test suite plus override go vet. Production use of the override endpoint remains unverified, as noted in the PR description.