Support configurable package.json overrides/resolutions during project creation

[acere]

Description

When running agentcore create in corporate/enterprise environments that use private npm registries (e.g., Nexus, Artifactory), the generated CDK project's package.json can reference dependency versions that are quarantined or unavailable in the internal registry. This causes npm install to fail with 403 errors during project scaffolding, and there's currently no way to influence the generated package.json before install runs.

Use Case:

Organizations using proxied npm registries with firewall policies that quarantine unreviewed package versions will hit failures during agentcore create. The CDK project template may pull in transitive dependencies that are blocked by the internal registry. The entire project creation fails at the npm install step with:

npm error 403 Requested item is quarantined

Currently there is no way to specify overrides, resolutions, or pin specific dependency versions before the install runs.

Proposed Solution

Add support for one or more of the following:

1. A --npm-overrides flag (or config file option) that injects overrides / resolutions into the generated package.json before npm install executes.
2. A --skip-install flag that creates the project scaffolding without running npm install, allowing users to modify package.json before installing manually.
3. Support for a user-level or project-level config file (e.g., .agentcorerc) where registry-specific constraints can be defined and applied to all generated projects.

Acceptance Criteria

• Running agentcore create --skip-install generates the full project scaffolding without executing npm install or uv sync.
• The CLI outputs a clear message indicating that dependency installation was skipped and must be done manually.
• Running agentcore create --npm-overrides '{"<package>": "<version>"}' (or equivalent syntax) injects the provided overrides into the generated package.json before npm install runs.
• The overrides field in the generated package.json is valid and correctly merged if the template already contains overrides.
• The --skip-install and --npm-overrides flags are documented in agentcore create --help.
• Existing behavior (no flags) remains unchanged — npm install and uv sync still run by default.
• The feature works across supported platforms (Windows, macOS, Linux).

Additional Context

This is likely a common pain point for any enterprise team using agentcore-cli behind a corporate registry proxy. A --skip-install flag alone would be a low-effort, high-impact improvement.

[jesseturner21]

Added --skip-install that prevents npm install and uv sync