feat(harness): reconcile execution role policies

[aidandaly24]

Summary

• replace the static Harness execution-role policy with capability-driven planning and shared IAM reconciliation
• stage current and desired permissions around updates, wait for the exact returned Harness version, finalize managed Memory ARNs, restore on failure, and clean up only the generated policy on delete
• support exact Browser, Code Interpreter, Gateway auth, model, credential-provider, private ECR, S3, EFS, and S3 Files permissions
• preserve external IAM behavior for --execution-role-arn, unknown roles, deterministic cross-resource ownership, and --skip-role-policy-update
• surface external-IAM warnings in both CLI and TUI update flows

Stack

Depends on #75.

Verification

• bun run format:check
• bun run lint:check
• bun run typecheck
• focused Harness/IAM and Gateway regression suites
• bun test: 1238 passed, 0 failed
• bun run build
• live AWS_PROFILE=deploy create/update/invoke/delete coverage for managed Memory, Browser, Code Interpreter, AWS IAM and no-auth Gateways, API-key-backed remote MCP, explicit roles, skipped IAM, unknown roles, failed-update rollback, and generated-policy cleanup
• all disposable Harnesses, Memories, roles, policies, and log groups confirmed removed

[aidandaly24]

Superseded by upstream draft PR aws#1991.