docs: add least-privilege deployment roles and deployment guide

Add DEPLOYMENT_ROLES.md with least-privilege IAM policy for the
CloudFormation execution role (IaCRole-ABCA), derived from analysis
of all CDK constructs and handler code in the current single-stack
architecture. Includes optional ECS statements when Fargate is enabled.

Add DEPLOYMENT_GUIDE.md covering compute backend choices (AgentCore
vs opt-in ECS Fargate via ComputeStrategy), scale-to-zero analysis,
and complete AWS services inventory.

Update COST_MODEL.md with scale-to-zero characteristics section,
corrected baseline to ~$85-95/month, and updated references.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scottschreckengaust

docs/design/COST_MODEL.md

@@ -16,7 +16,11 @@ These costs are incurred regardless of task volume:
 | DynamoDB (on-demand, idle) | ~$0/month | Pay-per-request; no cost when idle. |
 | CloudWatch Logs retention | ~$1–5/month | Depends on log volume. 90-day retention. |
 | API Gateway (idle) | ~$0/month | Pay-per-request. |
-| **Total baseline** | **~$85–90/month** | |
+| **Total baseline** | **~$85–95/month** | |
+
+### Scale-to-zero characteristics
+
+Most platform components are fully serverless and incur zero cost when idle: DynamoDB (PAY_PER_REQUEST), Lambda, API Gateway, ECS Fargate (cluster is free, when enabled), AgentCore Runtime (per-session), Bedrock (per-token), and Cognito (free tier). The always-on cost floor (~$85–95/month) is dominated by VPC networking infrastructure (NAT Gateway + 7 interface endpoints) which is required for private subnet connectivity to AWS services and GitHub. See the [Deployment guide](../guides/DEPLOYMENT_GUIDE.md) for the full scale-to-zero breakdown.
 
 ## Per-task variable costs
 
@@ -85,7 +89,8 @@ For multi-user deployments, cost should be attributable to individual users and
 
 ## Reference
 
-- [COMPUTE.md  - Network architecture](./COMPUTE.md)  - VPC infrastructure cost breakdown.
-- [ORCHESTRATOR.md](./ORCHESTRATOR.md)  - Polling cost analysis.
-- [COMPUTE.md](./COMPUTE.md)  - Compute option billing models.
-- [OBSERVABILITY.md](./OBSERVABILITY.md)  - Cost-related metrics (`agent.cost_usd`, token usage).
+- [Deployment guide](../guides/DEPLOYMENT_GUIDE.md) -- Deployment choices, scale-to-zero analysis, AWS services inventory.
+- [DEPLOYMENT_ROLES.md](./DEPLOYMENT_ROLES.md) -- Least-privilege IAM policies for deployment.
+- [COMPUTE.md](./COMPUTE.md) -- VPC infrastructure cost breakdown, compute option billing models.
+- [ORCHESTRATOR.md](./ORCHESTRATOR.md) -- Polling cost analysis.
+- [OBSERVABILITY.md](./OBSERVABILITY.md) -- Cost-related metrics (`agent.cost_usd`, token usage).