Feature: suggest making IMDSv2 a default

### What would you like to be added?

In certain environments where IMDSv1 is disabled (e.g. setting enforced via preventive policies), self-provisioning a workshop will fail:

`{"level":"error","ts":"2026-08-19T08:32:30Z","logger":"setup","msg":"unable to initialize AWS cloud","error":"failed to introspect vpcID from EC2Metadata or Node name, specify --aws-vpc-id instead if EC2Metadata is unavailable: failed to fetch VPC ID from instance metadata: EC2MetadataError: failed to make EC2Metadata request\n\n\tstatus code: 401, request id: "}`

- alternative error is a timeout issue due a single-hop.

### Why is this needed?

Suggest to adapt a managed node group config to use IMDSv2 by default. e.g:

```
module "eks" {
source = "terraform-aws-modules/eks/aws"
# ...
eks_managed_node_groups = {
default = {
# ... existing config ...
metadata_options = {
http_endpoint = "enabled"
http_tokens = "required"
http_put_response_hop_limit = 2
}
}
}
}
```

Find the workshop's Terraform configuration for the EKS managed node group and compare its current metadata settings with the requested IMDSv2 defaults. Update the default configuration and validate that self-provisioning works when IMDSv1 is disabled, including the requested hop limit.

Written by the indexing model from the issue text.