feat(gateway): complete execution role policy management

[aidandaly24]

Stack

Depends on #73. Base this PR on feat/gateway-iam-reconciliation.

Summary

• Complete Gateway execution-role planning for API Gateway, Runtime, S3 schemas, managed Knowledge Bases, Bedrock Mantle, interceptors, custom transforms, OAuth, API keys, caller IAM, JWT passthrough, and no-auth targets.
• Reconcile C ∪ D around Gateway and Target updates, restore C on confirmed failure, retain the transition policy on unknown outcomes, and tighten to exact D after terminal success.
• Reconcile child deletion only after confirmed absence; remove only the generated per-Gateway policy after parent deletion; leave the IAM role and external policies untouched.
• Add --skip-role-policy-update to Gateway, Target, and Connector updates, with preflight warnings for unknown roles and explicit customer-role handling.
• Resolve credential-provider backing secret ARNs before policy compilation and accept standard matching aws:SourceAccount / aws:SourceArn trust conditions for recognized console roles.
• Record asynchronous fixture response sequences so update/delete replay preserves real status transitions and IAM read-back behavior.

Verification

• bun test --coverage: 1,217 passed, 11,182 assertions, 94.27% lines, 98.04% functions.
• Focused Gateway/shared-IAM suite: 206 passed, 1,526 assertions.
• bun run typecheck
• bun run lint:check
• bun run format:check
• git diff --check
• bun run build
• bun pm pack --destination /tmp/pr3-pack
• Extracted tarball help smoke for Gateway update/delete and Target/Connector update.
• Recorded and replayed managed Gateway update and delete lifecycles with AWS_PROFILE=deploy.

Live Matrix

Using the dedicated deploy account:

• Shared Lambda permission deduplication, Lambda A to B replacement, and final-owner deletion.
• S3 OpenAPI schema object access.
• API Gateway REST API stage target.
• Disposable Bedrock managed Knowledge Base connector.
• OAuth and API-key provider, workload identity, and backing secret grants.
• Request interceptor and custom transform Lambda grants.
• No-auth, caller-IAM, and JWT-passthrough no-grant variants.
• AgentCore Runtime IAM target.
• Bedrock Mantle model discovery and inference grants.

Every disposable Gateway, role, managed Knowledge Base, REST API, and S3 bucket was independently confirmed absent after testing.

[aidandaly24]

Superseded by upstream draft PR aws#1990.