* fix(infra): allow scoped apply to create the EC2 recover alarm
PutMetricAlarm with the automate recover action needs RecoverInstances plus CreateServiceLinkedRole for AWSServiceRoleForCloudWatchEvents, which does not exist in seahaven-prod yet.
* docs: record prod EIP and bootstrap-then-scoped apply split
Bootstrap cannot CreateVpc; the live collector is 184.193.220.187 until UniFi is re-pointed.