feat: add refreshable Bedrock IAM role credentials

[JWThewes]

Summary

Adds Bedrock IAM role as an administrator-selectable credential mode, building on Johan Esbjörner's work in esbjj/sample-collaborative-ai-dlc#4. The final source tree was imported as one attributed change set and then hardened for the current v2 architecture.

• Adds explicit API key and IAM role modes for Bedrock while leaving Kiro API-key authentication unchanged.
• Keeps role assumption in the credential broker. Customer trust policies name only the broker role; the AgentCore execution role receives no sts:AssumeRole or direct Bedrock grant.
• Makes the mandatory Bedrock session-policy ceiling fail closed. Missing, empty, malformed, or over-broad configuration is rejected before STS is called.
• Preserves typed credential failures through AgentCore and the v2 orchestrator without exposing sensitive messages.
• Adds renewable one-hour STS sessions for active stages through an invocation-scoped, token-protected loopback container-credentials endpoint. Static STS values are discarded before the CLI starts, refresh grants are bounded to the active execution/project/binding, and MCP children receive neither credentials nor refresh authority.
• Re-resolves and revalidates the current binding and mandatory ceiling for every refresh; invocation completion, cancellation, or token revocation closes the endpoint and scrubs in-memory credential state.
• Makes IAM mode authoritative at space/platform scope. Covered Bedrock bearer keys remain encrypted for rollback but are inactive and cannot bypass IAM; incompatible Bedrock key controls are disabled. Effective mode, source, scope, and inactive-key status are exposed without secrets.
• Supports Codex >= 0.149.1 (0.153.4 pinned) through the Bedrock Runtime OpenAI-compatible endpoint and global.openai.* CRIS profiles. Removes the obsolete bedrock-mantle:CreateInference permission.
• Fixes gated-stage artifact promotion so retries promote only artifacts emitted by the current stage attempt rather than stale rows from an earlier revision.
• Reconciles the ADR, specification, operator runbook, trust-policy templates, support matrix, and user documentation with the implemented contracts.

Trust and credential boundaries

1. The control plane stores the administrator's role binding and platform-generated external ID in SSM.
2. The broker validates an audience-separated signed grant, active execution state, project, binding, and mandatory session ceiling before calling AssumeRole.
3. AgentCore exposes credentials only through a loopback-only endpoint protected by a per-invocation authorization token.
4. Only the selected top-level Bedrock CLI receives the container-credentials URI/token. Reserved and custom MCP children receive neither refresh authority nor static AWS credentials.
5. Role ARN, external ID, STS credentials, and refresh tokens are redacted from application responses, logs, and persisted stage state.

Terraform and IAM safety

• The generated inference grant is constrained to the required inference-profile, foundation-model, streaming, and Codex Runtime resources/actions; generated-policy tests assert that no Mantle action or resource is emitted.
• Mandatory session-ceiling configuration is wired to every resolver path, and same-account/cross-account trust outputs name only the broker role. Cross-account templates add the platform-generated external ID; no sts:TagSession permission is required.
• Terraform formatting, backend-disabled initialization, validation, and focused terraform test policy/output assertions passed. No Terraform apply was run.
• No generated credentials, local backend override, lockfile drift, or Terraform plan artifact is included in this branch.
• A fresh account-backed saved plan was not reproducible in this execution environment because deployment state, concrete tfvars, and an authenticated AWS profile were unavailable. Deployment should retain the existing protected plan/audit/apply workflow, with particular review of Cognito, Neptune, S3, and persistent DynamoDB resources before apply.

Validation

Local verification covered:

• focused broker, grant, mandatory-ceiling, metadata, capability, AgentCore HTTP, child-environment, active-stage refresh, and gate-resume suites;
• v2 orchestrator typed-dispatch and gated artifact-promotion regressions;
• backend credential-mode precedence, write validation, effective-source reporting, and authorization boundaries;
• frontend credential-mode component, accessibility, intent-view, TypeScript, and production-build checks;
• repository formatting, linting, secret scanning, dependency audit, backend/frontend tests, release tests, and Terraform validation/policy tests.

CI remains authoritative for container-backed DynamoDB/Gremlin integration and the complete supported Node matrix.

Operational limits

• Role chaining hard-caps each STS session at 3600 seconds. Refresh removes the one-hour stage limit; it does not increase an individual session lifetime.
• A stage attempt may run for up to eight hours and can obtain multiple one-hour sessions without replaying the stage. Gate and user-answer waits persist no temporary STS credentials; the next stage resolves a fresh session.
• An already-minted credential can outlive binding revocation for up to 3600 seconds. There is no in-flight STS revocation; delete/recreate or cancel prevents future refreshes, not use of an already-issued session.
• The broker remains a shared availability boundary, and Bedrock quotas remain shared per account/model/region.
• Codex GPT profiles currently require global CRIS routing. Administrators must decide whether that routing satisfies their data-residency policy before enabling Codex.
• External IDs are stable for a platform scope and are reused across role-ARN changes in this release; re-saving does not rotate them.