feat(gateway): manage execution role policies

[aidandaly24]

Summary

• create a deterministic Gateway execution role when --role-arn is omitted
• leave explicit roles untouched, warn for unrecognized associated roles, and support --skip-role-policy-update
• derive one exact CLI-owned inline policy from complete Gateway and Target state
• stage current union desired before mutations, wait for terminal state, then finalize or restore
• remove obsolete Target grants and delete only the generated policy after parent deletion

Permission coverage

• Policy Engine, Lambda, Web Search, Knowledge Bases, Runtime, API Gateway, S3 schemas, interceptors, custom transforms, and Bedrock Mantle
• API key, OAuth client credentials, authorization code (3LO), token exchange, JWT passthrough, and Token Vault customer-managed KMS keys

Scope

This is the Gateway-only implementation. It intentionally does not add a cross-primitive compiler, ownership graph, drift reconciler, policy compaction framework, or IAM management for customer-provided roles.

Execution-role reconciliation supports one writer at a time per Gateway. Cross-process locking and concurrent Gateway-family mutations are outside V1. If Gateway deletion remains indeterminate after retries, the generated policy is retained rather than risking permission removal from a live Gateway; after confirming deletion, the policy can be removed manually.

The PR is based on refactor, which includes the merged Gateway CRUD stack.

Verification

• Linux, Windows, and macOS unit-test jobs passed
• 156 focused Gateway tests passed
• CodeBuild e2e passed
• typecheck, lint, formatting, and bundle build passed
• fixture-backed Gateway create, update, and delete flows replayed
• live deploy-account validation:
  • managed role creation and failed-create cleanup
  • Policy Engine create/update policy changes
  • Lambda and Web Search runtime invocation
  • observed current union desired during a live Lambda update
  • operation failure restored the previous policy
  • API key retrieval and forwarding
  • Cognito CUSTOM_JWT rejection and successful invocation
  • OAuth client credentials, authorization-code 3LO, and token exchange
  • JWT passthrough with an unchanged role-policy hash
  • AWS_IAM SigV4 invocation
  • BYO-role non-mutation and explicit skip behavior
  • Target and parent deletion policy cleanup

All disposable Gateways, Targets, roles, and Cognito resources were removed after testing.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.75582% with 67 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.71%. Comparing base (9d63f5b) to head (5901331).
⚠️ Report is 4 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/core/gateway.tsx	93.27%	31 Missing ⚠️
src/core/gatewayExecutionRole.ts	86.50%	27 Missing ⚠️
src/core/gatewayPolicy.ts	97.00%	9 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #1994      +/-   ##
============================================
- Coverage     96.88%   96.71%   -0.18%     
============================================
  Files           342      345       +3     
  Lines         19263    20286    +1023     
============================================
+ Hits          18663    19619     +956     
- Misses          600      667      +67     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.