[prateekchaudhry]

Summary

Aligns the SSM "execute-command" binary download in scripts/ecs-anywhere-install.sh with the pattern already used by install-ssm-agent() in the same script: stage the download in a root-owned temporary directory, verify the downloaded tarball's signature, and promote the binaries with install.

Implementation details

• Staging directory: replaced the current-working-directory–relative ssm-binaries directory with a root-owned mktemp -d directory.
• Download: switched the raw curl -o to the existing curl-helper (uses curl -f, so an HTTP error aborts rather than writing an error body to disk).
• Signature verification: when CHECK_SIG is true (default; disabled via --skip-gpg-check), download the tarball's .sig and verify it with the existing ssm-agent-signature-verify helper, failing closed on a bad signature. This applies the same CHECK_SIG-gated verification that install-ssm-agent() already performs for the SSM agent .deb/.rpm package, using the same helper and signing key, so no new verification behavior, function, or key is introduced.
• Promotion: replaced mkdir -p + cp with install -D -m 0755, which creates the destination directory and sets the file mode in one step.

Testing

Manually verified ECS-A registration with script changes. External instance is registered with ecs.capability.execute-command attributes.

New tests cover the changes:
No new changes

Description for the changelog

Enhancement - Stage ecs-anywhere exec binaries in a temporary directory and verify their signature

Additional Information

Does this PR include breaking model changes? If so, Have you added transformation functions?

Does this PR include the addition of new environment variables in the README?

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.