fix(interrupt): correct malformed FIS role trust policy

[frank-bee]

Problem

roc interrupt fails whenever the aws-fis-itn FIS role doesn't already exist. The trust policy literal nests the service principal as a sub-array:

"Principal": {
    "Service": [
      ["fis.amazonaws.com"]
    ]
}

IAM rejects this on CreateRole:

MalformedPolicyDocument: Syntax error at position (8,9)

(Position (8,9) is exactly the inner [.) All pre-flight checks pass — it only fails at role creation — so the command is unusable on first run in any account.

Reported in #22.

Fix

Flatten Principal.Service to a plain string:

"Principal": {
    "Service": "fis.amazonaws.com"
}

Added TestTrustPolicyIsValidForIAM to guard against the nested-array regression (asserts Principal.Service decodes as a string or flat []string).

Testing

• go build ./... — OK
• go test ./internal/cli/ -run TestTrustPolicyIsValidForIAM — PASS
• Verified end-to-end against a real RunsOn Flex stack: with the corrected policy, roc interrupt creates the role and runs the FIS spot-interruption experiment successfully.