feat(bedrockagentcore): add filesystem configuration to Runtime

[mazyu36]

Issue # (if applicable)

N/A

Reason for this change

The Runtime L2 did not expose filesystemConfigurations, so users could not configure managed session storage without dropping down to L1.

Description of changes

Adds filesystems: Filesystem[] on the Runtime with a Filesystem.sessionStorage(mountPath) factory. The array shape matches the CFN model (MaxItems = 5) so additional Filesystem factories can be added later without breaking the API.

new agentcore.Runtime(this, 'Runtime', {
  agentRuntimeArtifact,
  filesystems: [
    agentcore.Filesystem.sessionStorage('/mnt/workspace'),
  ],
});

Synth-time validations (per docs): up to 5 filesystems total, at most 1 managed session storage, mount path pattern/length, mount paths unique and not subdirectories of each other (Token-safe).

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Unit tests for rendering, validations, and limits (140/140 pass).
• Existing integration test rewritten to the new API; snapshot unchanged.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.
To suppress a specific rule, see Suppressing Rules.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[github-actions]

👋 It looks like your PR description follows the template but is missing a valid issue number in the first section.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to include a reference like Closes #123. If no existing issue matches your change, create one first.