feat(gateway): manage execution role policies

[aidandaly24]

Summary

• create a deterministic Gateway execution role when --role-arn is omitted
• leave explicit roles untouched, warn for unrecognized associated roles, and support --skip-role-policy-update
• derive one exact CLI-owned inline policy from complete Gateway and Target state
• stage current union desired before mutations, wait for terminal state, then finalize or restore
• remove obsolete Target grants and delete only the generated policy after parent deletion

Permission coverage

• Policy Engine, Lambda, Web Search, Knowledge Bases, Runtime, API Gateway, S3 schemas, interceptors, custom transforms, and Bedrock Mantle
• API key, OAuth client credentials, authorization code (3LO), token exchange, JWT passthrough, and Token Vault customer-managed KMS keys

Scope

This is the Gateway-only implementation. It intentionally does not add a cross-primitive compiler, ownership graph, drift reconciler, policy compaction framework, or IAM management for customer-provided roles.

Execution-role reconciliation supports one writer at a time per Gateway. Cross-process locking and concurrent Gateway-family mutations are outside V1. If Gateway deletion remains indeterminate after retries, the generated policy is retained rather than risking permission removal from a live Gateway; after confirming deletion, the policy can be removed manually.

The PR is based on refactor, which includes the merged Gateway CRUD stack.

Verification

• Linux, Windows, and macOS unit-test jobs passed
• 156 focused Gateway tests passed
• CodeBuild e2e passed
• typecheck, lint, formatting, and bundle build passed
• fixture-backed Gateway create, update, and delete flows replayed
• live deploy-account validation:
  • managed role creation and failed-create cleanup
  • Policy Engine create/update policy changes
  • Lambda and Web Search runtime invocation
  • observed current union desired during a live Lambda update
  • operation failure restored the previous policy
  • API key retrieval and forwarding
  • Cognito CUSTOM_JWT rejection and successful invocation
  • OAuth client credentials, authorization-code 3LO, and token exchange
  • JWT passthrough with an unchanged role-policy hash
  • AWS_IAM SigV4 invocation
  • BYO-role non-mutation and explicit skip behavior
  • Target and parent deletion policy cleanup

All disposable Gateways, Targets, roles, and Cognito resources were removed after testing.