docs: clarify getPublicENI function purpose

Add doc comment explaining that device index 0 is the primary ENI
where Elastic IPs are attached for NAT instances.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: leonardosul

cmd/lambda/ec2ops.go

@@ -293,6 +293,9 @@ func (h *Handler) releaseEIPs(ctx context.Context, eips []ec2types.Address) {
 
 // --- ENI helper ---
 
+// getPublicENI returns the primary network interface (device index 0).
+// For NAT instances launched via our templates, this is the public-facing ENI
+// where the Elastic IP should be attached.
 func getPublicENI(inst *Instance) *ec2types.InstanceNetworkInterface {
 	for i := range inst.NetworkInterfaces {
 		if aws.ToInt32(inst.NetworkInterfaces[i].Attachment.DeviceIndex) == 0 {