EksPodOperator deferrable mode fails on remote triggerers — credential temp file not available

### Apache Airflow Provider(s) amazon ### Versions of Apache Airflow Providers apache-airflow-providers-amazon==9.18.0 ### Apache Airflow version 3..x.x ### Operating System Debian/Ubuntu-based containers (Astronomer Runtime, official Airflow images) ### Deployment Astronomer ### Deployment details Any deployment where the triggerer runs on a different host than the worker (Astronomer, MWAA, distributed Airflow with separate triggerer pods). ### What happened `EksPodOperator` with `deferrable=True` fails with 401 Unauthorized when the triggerer runs on a separate host from the worker (e.g., Astronomer, MWAA). The root cause is that the credential temp file created during `execute()` is not available on the triggerer when it tries to poll the pod. **The credential lifecycle during deferral:** 1. `EksPodOperator.execute()` calls `eks_hook.get_session()` to extract AWS credentials 2. `_secure_credential_context()` writes them to a temp file on the **worker** (e.g., `/tmp/tmpXYZ`) 3. `generate_config_file()` creates a kubeconfig with an exec block that references that temp file: ```yaml users: - name: aws user: exec: command: sh args: ["-c", ". /tmp/tmpXYZ; python -m airflow...utils.eks_get_token ..."] ``` 4. `KubernetesPodOperator.invoke_defer_method()` calls `convert_config_file_to_dict()`, which reads the kubeconfig into a dict — **including the exec block with the temp file path** 5. The task defers, the context managers exit, and **both temp files are deleted** (the credential file and the kubeconfig file) 6. The trigger is serialized to the metadata DB with `config_dict` containing the now-stale temp file path 7. The **triggerer** (on a different host) deserializes the trigger and calls `load_kube_config_from_dict(config_dict)` 8. `kubernetes_asyncio` processes the exec block and runs `sh -c ". /tmp/tmpXYZ; ..."` 9. `/tmp/tmpXYZ` doesn't exist on the triggerer → credentials not loaded → 401 Unauthorized **Error o…