(2026.06) Custom launch script fails to download when VDI starts with 403 Forbidden error

## Bug description

When using the "Run script when VDI starts" feature in a project, the custom launch script fails to download from S3 with a `403 Forbidden` error. The VDI instance does not have the required S3 permissions to read the custom launch script, causing the script execution to fail during VDI startup. The "Run script when VDI is configured" feature is not affected.

## Affected versions

2026.06

## Mitigation

Create an IAM policy that grants S3 read access to objects tagged with your RES environment name, and attach it to your RES project:

1. Open the [IAM Console](https://console.aws.amazon.com/iam/) and create a new policy with the following JSON, replacing `` with the name of your RES environment:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"s3:ExistingObjectTag/res:EnvironmentName": ""
}
}
}
]
}
```

2. Tag the IAM policy with the following tag so that RES can discover it:
- **Key:** `res:Resource`
- **Value:** `vdi-host-policy`
3. In the RES web portal, navigate to your project settings and attach the IAM policy to the project under the **Resource Configurations -> Advanced Options -> Add Policies** section.
4. Launch a new VDI from the project. The custom "on VDI started" script should now download and execute successfully.

## Rollback

Remove the IAM policy from the project settings in the RES web portal. No other rollback steps are required.

Start by locating the implementation of the “Run script when VDI starts” feature and tracing its S3 download and IAM-policy handling, then compare it with the unaffected configured-start feature. Reproduce the 403 during a new VDI launch and verify that the custom script downloads and executes successfully without the mitigation policy.

Written by the indexing model from the issue text.