feat(identity): add payment credential provider mutations

[aidandaly24]

Description

First CUD layer of the payment stack, following read-only PR #2276.
Manager/connector mutations follow in #2280; session/instrument mutations follow in #2281.

Adds identity payment-credential-provider create|update|delete for Coinbase CDP
and Stripe/Privy. Includes vendor-specific flags, managed/file/stdin and external
secret inputs, and validation before consuming competing stdin sources.

The existing payment credential validator moves from the project handler to the
provider handler; the project path reuses it. This layer adds no payment manager,
connector, session, or instrument mutations and no IAM provisioning.

This is a scope split of the already-verified implementation, not new behavior
or new test suites. Get/list coverage is inherited from #2276.

Updated against refactor at 4a235162. Secret/reference alternatives use
assertMutuallyExclusiveFlags from #2263, with the standard error wording.
Vendor validation and competing-stdin checks still run before input is consumed.

Related Issue

Part of #2272. The later CUD layers complete the headless feature.

Documentation PR

N/A. README command tree and provider creation example are included.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

• RECORD=0 bun test: 3,295 passed across 230 files.
• bun run typecheck, bun run lint:check, bun run format:check
• bun run build, bun run secrets:check
• Scope checked against the read-only base: only provider mutations and their shared validator.
• Linux, Windows, and macOS CI on d7cd656e: https://github.com/aws/agentcore-cli/actions/runs/34625574168

Uses the repository's Bun scripts rather than the npm scripts from the main-branch template.
No AWS resources were changed or fixture lifecycles re-recorded while splitting the stack.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

PR #2276 is the outstanding dependency.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice work on this. The scope is large (manager/connector/session/instrument mutations plus payment credential provider mutations), but the design is coherent and the tests are structured well:

• PaymentClient cleanly delegates credential-provider lookup to the identity sub-client, so ARN-vs-name resolution isn't duplicated (src/core/payment.tsx).
• Default service-role provisioning (src/core/paymentServiceRole.ts) uses regional role names with a hash suffix past 64 chars, ownership tags gated with a strict "every tag matches" check, and a scoped inline policy — matching the CDK L3 construct's ResourceRetrievalRole. The "long name in Node" test is a nice touch.
• The retry predicate in isServiceRoleUnusable (payment.tsx L468-474) correctly distinguishes a service-role propagation error from a caller's own AccessDenied by matching against the provisioned role's ARN/name, and there's an explicit test for it (payment.test.ts "does not retry a caller's own access denial").
• Extracting retryWhileRoleUnassumable out of harness.tsx into roleRetry.ts is a reasonable factoring; the harness call site is unchanged.
• E2E flow tests (create → update → delete) drive the real router + CoreClient against fixture-backed SDK fakes, and the test harness at the SDK seam avoids excessive mocking. The stdin-collision tests actually verify read is never called, which is exactly the guarantee the "fail fast before consuming stdin" comment claims.
• Documentation in README.md covers the default-role ownership and IAM-permission requirements up front, and the Quick Create/BYO-credentials workflows are laid out end-to-end.

A couple of very minor observations that don't need to change:

• ensurePaymentServiceRole doesn't handle the concurrent NoSuchEntityException → CreateRole → EntityAlreadyExistsException race, but the CLI runs one operation at a time so this is theoretical.
• updatePaymentConnector (payment.tsx L244) passes description: input.description unconditionally rather than spread-if-defined; the SDK ignores undefined fields, so no behavior change.

The prompt mentions checking for telemetry instrumentation per src/cli/telemetry/README.md, but that file doesn't exist and no comparable payment/identity read-side handlers in the codebase emit telemetry either, so I don't see a gap to flag here. If a telemetry convention lands later, these handlers will need to be revisited alongside their siblings.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.17%. Comparing base (38c4d07) to head (d7cd656).

Additional details and impacted files

@@                    Coverage Diff                     @@
##           feat/payment-read-only    #2277      +/-   ##
==========================================================
+ Coverage                   97.08%   97.17%   +0.08%     
==========================================================
  Files                         587      591       +4     
  Lines                       39887    40172     +285     
==========================================================
+ Hits                        38724    39036     +312     
+ Misses                       1163     1136      -27     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.