feat(identity): add identity scaffolding and CRUDL operations for api key

[nborges-aws]

Description

Adds identity scaffolding, as well as command-line CRUDL for Identity API key credential providers:

• identity api-key-credential-provider create
• identity api-key-credential-provider get
• identity api-key-credential-provider list
• identity api-key-credential-provider update
• identity api-key-credential-provider delete

Follows the structure established by harness and runtime for commands. Create/update accept --name and --api-key, get/delete accept just name, list accepts --max-results and --next-token. Similar to runtime, identity will appear in the TUI command menu at the root, but prints help pending TUI routing.

Additional change to move generic default help handler created for runtime to src/handlers/help.tsx to avoid duplication. This PR updates runtime call sites to point to new help handler.

Testing

Tested via fixture tests against live AWS resources, as well as manual dogfooding via running the build artifact in CLI.

Related Issue

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

Verified from current HEAD:

• bun test (274 pass, 0 fail)
• bun test src/handlers/identity src/handlers/runtime src/core (39 passed, 0 failed)
• bun run lint:check
• bun run format:check (prettier --check)
• bun run typecheck (clean in src/)
• bun run build

Additional verification:

• All five CRUDL commands verified against live AWS (us-west-2)
• Manual dogfooding via built CLI artifact (bun dist/index.js identity api-key-credential-provider {create,get,list,update,delete})
• Help output confirmed for bare identity and identity api-key-credential-provider groups

The committed identity fixtures were recorded with RECORD=1 against a live account in us-west-2. The RECORD run creates two providers (agentcore-cli-identity-fixture, agentcore-cli-identity-fixture-2), exercises pagination, then deletes both. The fixture set contains no credential material (API key values are not returned by the service).

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (56f62e7) to head (698b699).

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #1811      +/-   ##
============================================
+ Coverage     93.94%   94.11%   +0.16%     
============================================
  Files           122      130       +8     
  Lines          6462     6648     +186     
============================================
+ Hits           6071     6257     +186     
  Misses          391      391              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.