test(eks): validate and graduate control-plane upgrades on AWS

> 🤖 Generated by the Agentic Engineer

The explicit EKS control-plane upgrade feature in #6925 ships default-off pending live AWS validation. Parent: #4328.

Before deleting the experimental gate, use an explicitly authorized disposable EKS cluster to observe a single-minor upgrade, AWS terminal update success, Kubernetes API version/readiness, worker/add-on behavior, cancellation/retry, stale-identity refusal, no-op retry and cleanup. Preserve sanitized exact-version/commit evidence. Do not infer live cluster correctness from hermetic fixtures.

Acceptance criteria: all required scenarios are recorded, no unrelated cluster-stack or networking mutation occurs, the documentation matches observed behavior, and a separate reversible PR removes the flag only after review. Size: medium. Blocked by #6925.

Start with the blocked implementation in #6925 and its parent context in #4328; the issue names no files or tests. Use an explicitly authorized disposable EKS cluster to record the listed upgrade scenarios and sanitized exact-version/commit evidence. Done means all scenarios are documented, no unrelated mutations occur, documentation matches observations, and a separate reversible flag-removal PR is reviewed.

Written by the indexing model from the issue text.