[DRAFT] feat(gateway): reconcile managed execution role policies

[aidandaly24]

Summary

Depends on #1988.

• create and validate deterministic AgentCoreCliGateway-* roles when --role-arn is omitted while leaving explicit and unknown roles customer-managed
• reconcile one generated parent policy across Gateway create and Target create using full Target inventory
• support exact Gateway root, Policy Engine, Lambda Target, and Web Search permissions
• wait for terminal Gateway/Target state, preserve transition policy on unknown outcomes, recover ambiguous creates by name, and clean up only confirmed failed creates
• fail closed for permission-bearing Target/root variants deferred to the next stack layer
• add pre-mutation ownership notices without contaminating JSON stdout
• make IAM/control fixture replay stateful and record a uniquely named real lifecycle

Verification

• focused Gateway/IAM suite: 130 pass, 0 fail before final review fixes; final focused/post-commit suites pass
• full repository suite after all review fixes: 1,163 pass, 0 fail
• coverage: 94.08% lines, 98.01% functions
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• npm tarball and packaged gateway create --help smoke

Live verification in the isolated deploy account covered:

• managed NONE Gateway with Policy Engine
• Policy Engine pre-create gateway/* transition and exact post-READY tightening
• Lambda Target creation and successful MCP tools/call
• Web Search Target creation and successful MCP tools/call
• managed AWS_IAM Gateway
• explicit customer role with zero inline-policy writes
• runtime IAM propagation behavior and stable operation tokens
• unique fixture recording and temporal replay

All disposable Gateways, Targets, Policy Engines, Lambda functions, and IAM roles were independently confirmed absent after cleanup.

[aidandaly24]

Withdrawing this draft stack for scope and architecture reduction before review.