pre-commit: check-json fails — duplicate key `iot` in aws4-shapes.json

Part of #213.

## Problem

`check-json` fails to decode a tracked JSON file because of a duplicate key:

```
plugins/deploy-on-aws/scripts/lib/aws4-shapes.json: Failed to json decode (Duplicate key: iot)
```

Duplicate keys are valid to most lenient parsers (last one wins) but are rejected by the strict `check-json` hook and are a latent correctness bug — whichever `iot` block is shadowed is silently ignored.

## Reproduce

```bash
mise exec -- pre-commit run check-json --all-files
```

## Proposed fix

Inspect the two `iot` entries in `aws4-shapes.json`, merge/deduplicate them (keeping the intended definition), and confirm the file still decodes. If the file is generated, fix the generator so it does not emit duplicate keys.

_{Filed with assistance from Claude Code while implementing #211.}

Start with plugins/deploy-on-aws/scripts/lib/aws4-shapes.json and inspect the two `iot` entries. Run `mise exec -- pre-commit run check-json --all-files`; if the file is generated, trace the generator before changing the output. Done means the intended definition is preserved, duplicate keys are removed, and the check passes.

Written by the indexing model from the issue text.