Use scripts/kuberly-cli-customer.bash in a kuberly-stack fork: source it, then kuberly sso <profile> (aws sso login), kuberly env (export CLUSTER_NAME / KUBERLY_ROLE / AWS_REGION from shared-infra.json), and kuberly plan|validate|init <module> (terragrunt run --iam-assume-role "$KUBERLY_ROLE"). Single-hop customer IAM, no maintainer controller-role. Triggers on "kuberly-cli-customer.bash", "kuberly sso", "kuberly env", "kuberly plan", or "how do customers run terragrunt without the controller hop".
