A working CLI is not evidence the SDK will run

A working CLI is not evidence the SDK will run `mise run check:aws` is documented in the README, and on an SSO profile it fails in a way that sends you looking in the wrong place. The `aws` CLI and the Rust SDK read different caches: the CLI can serve role credentials from its own after the SSO *portal* token has expired, while the SDK needs that portal token to fetch them at all. So `aws sts get-caller-identity --profile X` answers happily while the task dies on a 401 reading `Session token not found or invalid` — a message naming neither SSO nor `aws sso login`. Measured rather than inferred. The conformance run at 22:40Z passed; the portal token expired at 23:35Z; every run after that failed while the CLI kept working throughout. Diagnosed by reading the expiry out of `~/.aws/sso/cache` rather than by guessing at the error. Both the task and the README say it now, because the trap costs whoever hits it the same twenty minutes it cost here, and the error message actively points away from the answer.