feat(iam): add execution role policy reconciliation

[aidandaly24]

Summary

• add an allow-only PolicyContribution compiler with permission atom ownership, deterministic rendering and hashing, exact bipartite compaction, condition canonicalization, and IAM size validation
• add execution-role naming, documented-prefix recognition, trust validation, failed-create cleanup, and customer-role opt-out decisions
• add a serialized C -> C union D -> D/C policy updater with aggregate quota checks, IAM propagation handling, operation retries, rollback, drift detection, incomplete-inventory preservation, and post-create desired-state resolution
• add reusable AgentCore grant helpers plus Gateway, Harness, and online-evaluation scenario coverage

Base

iam/refactor-base is a fork-only pointer to AWS refactor at 531d0684789511fc19f60d4aa7a93f1688eb401e. The alternate name is required because this fork already contains a refactor/... branch namespace.

Verification

• focused IAM suite: 35 pass, 0 fail
• full repository suite: 1,141 pass, 0 fail
• coverage: 94.11% lines, 98.03% functions
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• npm tarball build and extracted dist/index.js --help smoke

Live verification in the isolated deploy account covered:

• CLI role creation, reuse, and trust validation
• initial generated policy write
• successful transition policy and exact final policy
• AgentCore-operation failure and exact current-policy restoration
• generated-child post-success finalization
• incomplete-inventory preservation of unread grants
• preservation of a separate customer inline policy
• aggregate inline-policy quota failure before the operation
• policy and role cleanup

The disposable role was independently queried after cleanup and returned NoSuchEntity.

[aidandaly24]

Superseded by upstream draft PR aws#1988.