feat(import): extract and pass through executionRoleArn from starter toolkit YAML

[jesseturner21]

Summary

• Parse the aws.execution_role field from .bedrock_agentcore.yaml and propagate it through the import pipeline into agentcore.json
• Adds optional executionRoleArn to AgentEnvSpecSchema, ParsedStarterToolkitAgent, YAML parser, and toAgentEnvSpec()
• Companion to CDK constructs PR: https://github.com/aws/agentcore-l3-cdk-constructs/pull/115

User Experience

Before (broken)

$ agentcore import --source .bedrock_agentcore.yaml -y
# ❌ execution_role from YAML is ignored
# ❌ agentcore.json has no executionRoleArn
# ❌ CDK creates a brand new IAM role, discarding the original

After (fixed)

$ cat .bedrock_agentcore.yaml
agents:
  my_agent:
    aws:
      execution_role: arn:aws:iam::123456789012:role/StarterToolkitRole
      ...

$ agentcore import --source .bedrock_agentcore.yaml -y
# ✅ CLI extracts execution_role from YAML

$ cat agentcore/agentcore.json
{
  "agents": [{
    "name": "my_agent",
    "executionRoleArn": "arn:aws:iam::123456789012:role/StarterToolkitRole",
    ...
  }]
}
# ✅ executionRoleArn written to agentcore.json
# ✅ CDK constructs (companion PR) will use this to import the role instead of creating a new one

Reverting to a CDK-managed role

Remove executionRoleArn from agentcore.json and run agentcore deploy — CDK will create a new role with standard policies.

Test plan

• 4 new unit tests: YAML parsing with/without execution_role, spec generation with/without executionRoleArn
• All existing 221 import tests pass
• E2E: agentcore import writes correct executionRoleArn to agentcore.json

🤖 Generated with Claude Code