fix(e2e): clean up stale credential providers before test runs (#698)

E2e tests create API key credential providers that leak when CI kills
the process before afterAll teardown runs. Over multiple runs these
accumulate and hit the account-level limit, causing all deploys to fail.

Add cleanupStaleCredentialProviders() in beforeAll that lists all E2e*
providers older than 1 hour and deletes them, preventing accumulation
regardless of how previous runs terminated.

Constraint: Only deletes providers with E2e prefix to avoid touching non-test resources
Constraint: 1-hour age threshold avoids deleting providers from a concurrent test run
Confidence: high
Scope-risk: narrow

Author: aidandaly24

e2e-tests/e2e-helper.ts

@@ -10,6 +10,7 @@ import {
   BedrockAgentCoreControlClient,
   DeleteApiKeyCredentialProviderCommand,
   GetAgentRuntimeCommand,
+  ListApiKeyCredentialProvidersCommand,
 } from '@aws-sdk/client-bedrock-agentcore-control';
 import { execSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
@@ -46,6 +47,8 @@ export function createE2ESuite(cfg: E2EConfig) {
     beforeAll(async () => {
       if (!canRun) return;
 
+      await cleanupStaleCredentialProviders();
+
       testDir = join(tmpdir(), `agentcore-e2e-${randomUUID()}`);
       await mkdir(testDir, { recursive: true });
 
@@ -329,6 +332,37 @@ export function installCdkTarball(projectPath: string): void {
   }
 }
 
+/**
+ * Delete stale E2e* credential providers older than the given max age.
+ * Runs in beforeAll to prevent accumulation from previous runs that
+ * crashed or timed out before their afterAll teardown could execute.
+ */
+export async function cleanupStaleCredentialProviders(maxAgeMs: number = 60 * 60 * 1000): Promise<void> {
+  const region = process.env.AWS_REGION ?? 'us-east-1';
+  const client = new BedrockAgentCoreControlClient({ region });
+  const cutoff = new Date(Date.now() - maxAgeMs);
+
+  let nextToken: string | undefined;
+  do {
+    const response = await client.send(new ListApiKeyCredentialProvidersCommand({ nextToken }));
+    const providers = response.credentialProviders ?? [];
+    const stale = providers.filter(p => p.name?.startsWith('E2e') && p.createdTime && p.createdTime < cutoff);
+
+    await Promise.all(
+      stale.map(async p => {
+        try {
+          await client.send(new DeleteApiKeyCredentialProviderCommand({ name: p.name! }));
+          console.log(`Cleaned up stale credential provider: ${p.name}`);
+        } catch {
+          console.warn(`Failed to clean up stale credential provider: ${p.name}`);
+        }
+      })
+    );
+
+    nextToken = response.nextToken;
+  } while (nextToken);
+}
+
 export async function teardownE2EProject(projectPath: string, agentName: string, modelProvider: string): Promise<void> {
   await spawnAndCollect('agentcore', ['remove', 'all', '--json'], projectPath);
   const result = await spawnAndCollect('agentcore', ['deploy', '--yes', '--json'], projectPath);