test(purchase): cover ApproveAndExecute refusal of an EC2 retry successor #780

Summary

Add a test that an EC2 retry successor is refused on the ApproveAndExecute path (token and session approve), not only through SQS ProcessMessage.

Current behaviour

internal/purchase/aws_no_token_redrive_test.go drives EC2/Redshift retry successors through ProcessMessage only. ApproveAndExecute and fireOneDue reach the same executeAndFinalize funnel and its armedRedriveRefusal backstop, so the refusal holds by structure and is covered for Azure by the armed tests, but there is no EC2 case on those entry points.

Steps to verify the gap

Read the new test and armed_redrive_test.go; no EC2 case calls ApproveAndExecute.

Expected behaviour

A retry successor (RetryAttemptN > 0) of an EC2 rec in pending status approved via ApproveAndExecute buys nothing and is persisted failed with the refusal reason.

Proposed fix

Add one case mirroring TestApproveAndExecuteRefusesArmedAzureSavingsPlanRetry with armedExecution("aws", "ec2", 1, "pending").

References

Parent: platform PR #778 (MON-02), review finding F3. Severity: low.