security: fail closed on ambient AWS credential fallback

[scottschreckengaust]

Problem

agent/src/bedrock_creds_helper.py returns ambient compute-role credentials when the attribution file is missing, malformed, or STS credential issuance fails.

Repository-controlled code can invoke the helper with a nonexistent attribution file, parse the credentials written to stdout, and use the compute role outside the intended task boundary. The role currently has permissions that may expose cross-workspace provider secrets and shared task resources.

Required behavior

Credential issuance must fail closed whenever task attribution is absent, malformed, forged, or cannot be validated.

Ambient compute credentials must never be returned to repository-controlled processes.

Scope

• Remove ambient credential fallbacks from agent/src/bedrock_creds_helper.py.
• Ensure task identity comes from trusted, immutable state.
• Reduce compute-role permissions to bootstrap-only access where possible.
• Remove direct repository access to wildcard provider-secret and shared-state permissions.

Acceptance criteria

• Missing attribution files return an error and no credential JSON.
• Malformed and forged attribution files return an error and no credentials.
• STS failures do not fall back to ambient credentials.
• Tests verify repository UID execution cannot obtain ambient credentials.
• IAM tests verify compute roles cannot read wildcard workspace secrets or modify shared concurrency state.
• Bedrock calls continue to work through validated task identity.

[scottschreckengaust]

Starting implementation