amis: split build/copy and publishing publicly into different steps

For a long time these scripts have always set images as public
regardless of whether the image was a working production image or not.
This may lead users to boot random development images if they happen to
pop up to the top of Amazon's terrible AMI search page.
amis: run build script as normal user

This reduces the awkwardness of passing credentials to the build job.

Replace run.sh with assorted example scripts for prod, master, etc.