fix: stop the RoleArn synth test printing AWS credentials into CI logs

[davehorton]

Urgent

Run 32995180996 printed
live AWS credentials into a public build log:

ok 60 successfully synthesized aws by roleArn audio to say:{...
  accessKeyId=ASIA...,secretAccessKey=...,sessionToken=IQoJ...

They are temporary (role chaining caps at 1 hour) and the role is scoped to
Polly/Transcribe only, so blast radius is limited - but they were valid when logged.
Delete that run's logs independently of merging this.

Cause

With renderForCaching unset, synthPolly returns the mediajam streaming params string,
and lib/synth-audio.js:337-340 embeds the credentials into it:

params += `,accessKeyId=${cred.accessKeyId}`;
params += `,secretAccessKey=${cred.secretAccessKey}`;
params += `,sessionToken=${cred.sessionToken}`;

The test interpolated that return value into its assertion message via opts.filePath.

Every other synth test in test/synth.js passes renderForCaching: true - twelve of them.
The RoleArn test was the sole exception, so it alone took the streaming path.

Latent from the day the test was written; it surfaced only once AWS_ROLE_ARN was
supplied and the test ran for the first time.

Fix

• add renderForCaching: true, matching every other synth test in the file
• stop interpolating opts.filePath into the assertion message, so the params string
  cannot leak this way again even if the flag changes

No library code is touched.

Generated with Claude Code