ci: install AWS CLI on self-hosted runner for S3 upload

.github/workflows/sample-distribution.yml

@@ -96,6 +96,26 @@ jobs:
           FIREBASE_CREDENTIALS_JSON: ${{ secrets.FIREBASE_CREDENTIALS_JSON }}
       # Publish the same APK to S3 for the public download link. Reuses the
       # artifact the Fastlane step above already built (app-build/), no rebuild.
+      - name: Ensure AWS CLI is available
+        if: github.ref == 'refs/heads/develop'
+        # The self-hosted `public` runner does not ship the AWS CLI. Install v2
+        # only when missing, to a user-writable dir (no sudo), then expose it.
+        run: |
+          if command -v aws >/dev/null 2>&1; then
+            echo "AWS CLI already installed: $(aws --version)"
+            exit 0
+          fi
+          echo "AWS CLI not found; installing v2..."
+          case "$(uname -m)" in
+            x86_64) zip="awscli-exe-linux-x86_64.zip" ;;
+            aarch64|arm64) zip="awscli-exe-linux-aarch64.zip" ;;
+            *) echo "Unsupported architecture: $(uname -m)"; exit 1 ;;
+          esac
+          curl -fsSL "https://awscli.amazonaws.com/${zip}" -o /tmp/awscliv2.zip
+          unzip -q /tmp/awscliv2.zip -d /tmp
+          /tmp/aws/install --bin-dir "$HOME/.local/bin" --install-dir "$HOME/.local/aws-cli" --update
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/aws" --version
       - name: Configure AWS credentials
         if: github.ref == 'refs/heads/develop'
         uses: aws-actions/configure-aws-credentials@v4