add gateway-target --help lists api-key outbound auth for target types the validator rejects

[jariy17]

Summary

agentcore add gateway-target --help advertises api-key as a valid --outbound-auth type for mcp-server (and for passthrough), but agentcore validate rejects it:

• mcpServer targets do not support API_KEY outbound auth
• Unsupported outbound auth type for passthrough: api-key

The validator is correct — AWS's gateway guide support matrix shows mcpServer supports only OAuth client-credentials or none. The help text is wrong, making an unsupported design look supported right up until deploy time.

Root cause

Outbound-auth validation is driven by a single source of truth, TARGET_TYPE_AUTH_CONFIG in src/schema/schemas/mcp.ts:

target type	valid outbound auth
mcp-server	oauth, none
lambda-function-arn / http-runtime	oauth, none
open-api-schema	oauth, api-key (required)
api-gateway	api-key, none
smithy-model	none (gateway IAM role)
passthrough	gateway-iam-role, oauth, jwt-passthrough

The --help text in src/cli/primitives/GatewayTargetPrimitive.ts is hand-written and had drifted, lumping all types under "oauth, api-key, or none".

Fix

Replace the single lumped Auth line in the --help output with a per-target-type breakdown matching TARGET_TYPE_AUTH_CONFIG, reword the --outbound-auth flag blurb to point at it, and add a regression test.

Reproduction

Reproducible on 0.24.2 and 1.0.0-preview.23 per customer feedback.

Reported via AWS console feedback (internal ref V2304968218).