feat(aws): Bedrock AgentCore agent composite — base path (#882)

[lex00]

Summary

• Adds AgentCoreAgent to the aws lexicon (lexicons/aws/src/composites/agentcore-agent.ts): a composite wiring Runtime + RuntimeEndpoint + Memory + Gateway/GatewayTarget + WorkloadIdentity + two IAM roles into one CloudFormation-serializable bundle. No CFN gap — every field the composite needs was already generated in lexicons/aws/src/generated.
• Adds examples/bedrock-agentcore-agent: an example deploying an AgentCore agent via cfn-deploy + wait-for-stack (the existing aws-lexicon capabilities), no bespoke verb. chant build/chant lint verified directly against the example.
• Spot-checked Runtime/RuntimeEndpoint/Memory against the live CloudFormation registry schema (all three required-field sets match exactly). One real finding from that check: their Name/AgentRuntimeName pattern (^[a-zA-Z][a-zA-Z0-9_]{0,47}$) rejects hyphens, unlike chant's usual kebab-case names — Gateway/GatewayTarget/WorkloadIdentity accept hyphens. The composite sanitizes names for the no-hyphen family and leaves the rest as-is; documented in the composite's doc comment.
• WorkloadIdentityDetails on both Runtime and Gateway is CFN readOnly (AWS auto-provisions it per-resource) — the WorkloadIdentity resource this composite creates is therefore standalone, included per the issue's resource list but not cross-wired (documented in-code).

Deferred (per issue, not implemented here)

The agentcore-deploy version-promotion capability (repointing RuntimeEndpoint's TargetVersion/LiveVersion at a new Runtime version, with rollback) stays out of scope — gated on a concrete promotion use case and on Bedrock AgentCore Runtime reaching GA. Also out of scope: invoking the deployed agent, and any of Loom's hosted-platform surface (UI/auth/registry/dashboards).

Test plan

• npm run build -w @intentius/chant-lexicon-aws passes
• aws lexicon vitest: 77 files / 891 tests pass (2 skipped, pre-existing)
• just lint clean
• just build clean (core untouched, ran anyway)
• Full repo npx vitest run: only 4 pre-existing, unrelated azure-lexicon roundtrip failures (confirmed present on origin/main too, independent of this change)
• chant lint src and chant build src --lexicon aws run directly against the new example — clean lint, valid CFN template with all 8 resources + 4 outputs, all cross-references resolved to Fn::GetAtt

Closes #882 (base path only — agentcore-deploy capability left as documented, GA-gated scope).