fix(ui): Hide Edit/Upgrade flows; document CloudShell day-2 commands

[ngjinshan]

The Edit (update.sh) and Upgrade (upgrade.sh) flows are disabled from the configurator landing page. Both had critical bugs:

• Upgrade: blows scoped_account_ids to ["ALL"] because new CFN parameters default to placeholder values when upgrading from older template versions that lacked those parameters.
• Edit: uses sed on template body which is incompatible with the new !Sub-based SSM config format.

Changes:

• Comment out Edit and Upgrade mode cards in configurator HTML
• Add Day-2 CloudShell commands to INSTRUCTIONS.md for add/remove accounts via update-stack-set parameter update
• Update README with CloudShell day-2 workflow and delete-redeploy upgrade path
• Document in-place upgrade limitation and reconciliation removal in LIMITATIONS.md

Description

Brief description of the change and the problem it solves.

Type of change

• Bug fix
• New resource type support
• Security improvement
• Documentation update

Testing

• Tested end-to-end in a real AWS account (or CI E2E will cover this)
• No false positives observed
• CloudWatch logs reviewed for errors

Checklist

• CloudFormation template is valid (cfn-lint passes — checked by CI)
• IAM permissions follow least-privilege (only tag actions added)
• If adding a new service handler: corresponding resource added to .github/scripts/resource_groups/ for E2E coverage
• CHANGELOG.md updated

CI Notes

Layer 1 (lint) runs immediately on every PR — ~1 min.
Layer 2 (E2E) runs when configurator.yaml or configurator.html changes — ~37 min across 7 AWS accounts. No AWS credentials needed.
If Layer 2 fails, download verification-report.json from the Actions run for details.