feat(import): extract and pass through executionRoleArn from starter toolkit YAML

[jesseturner21]

Summary

• Parse the aws.execution_role field from .bedrock_agentcore.yaml and propagate it through the import pipeline into agentcore.json
• Adds optional executionRoleArn to AgentEnvSpecSchema, ParsedStarterToolkitAgent, YAML parser, and toAgentEnvSpec()
• When present, CDK uses the existing IAM role instead of creating a new one

User Experience

Before

$ agentcore import --source .bedrock_agentcore.yaml -y
# execution_role from YAML is ignored
# agentcore.json has no executionRoleArn
# CDK creates a brand new IAM role, discarding the original

After

$ cat .bedrock_agentcore.yaml
agents:
  my_agent:
    aws:
      execution_role: arn:aws:iam::123456789012:role/StarterToolkitRole
      ...

$ agentcore import --source .bedrock_agentcore.yaml -y
# CLI extracts execution_role from YAML

$ cat agentcore/agentcore.json
{
  "agents": [{
    "name": "my_agent",
    "executionRoleArn": "arn:aws:iam::123456789012:role/StarterToolkitRole",
    ...
  }]
}
# executionRoleArn written to agentcore.json
# CDK uses this role instead of creating a new one

Reverting to a CDK-managed role

Remove executionRoleArn from agentcore.json and run agentcore deploy.

Test plan

• 4 new unit tests: YAML parsing with/without execution_role, spec generation with/without executionRoleArn
• npm run typecheck passes
• npm run lint passes (via pre-commit hook)

🤖 Generated with Claude Code

[github-actions]

Package Tarball

aws-agentcore-0.4.0.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-729-tarball/aws-agentcore-0.4.0.tgz