feat(eval): online-eval BYO execution role, remove auto-provisioning (P3)

[jariy17]

Draft · P3 of the online-insight stack. Stacked on #2069 (P2). Real-deploy bug bash done via RECORD; see below.

What

eval online-eval now requires the caller to bring their own execution role, and the CLI-side auto-provisioning is deleted entirely.

• create: --role-arn is now required (guard rejects a missing value with required option '--role-arn <role-arn>' not specified). It is passed straight through to CreateOnlineEvaluationConfig.
• update: --role-arn stays optional (replace); when omitted the service keeps the existing role.

Removed

• src/core/onlineEvalExecutionRole.tsx (+ its unit test) — the whole default-role provisioning module: grantOnlineEvalScope / revokeOnlineEvalScope / onlineEvalExecutionRoleName / scopePolicyName / executionPolicy / accountIdFromRoleArn.
• create's auto-provision fallback and the retryWhileRolePropagates IAM-propagation retry (a caller role that cannot be assumed now fails fast).
• update's --update-role flag, the managed-role grant/revoke/KMS re-scope block, and the entire role-scope-warning path (RoleScopeWarning type, stderr advisory). updateOnlineEvaluationConfig now returns the bare UpdateOnlineEvaluationConfigResponse.
• Now-dead helpers in core/eval.tsx: evaluatorKmsKeys, logGroupNamesOf (create no longer calls GetEvaluator or scopes a role).

Stack

P1 #2067 → P2 #2069 → P3 (this) → P4 TUI get/list. See the plan artifact.

Verification

• tsc --noEmit clean.
• online-eval goldens re-recorded against the AWS exploratory account (725476964917) — the real-deploy bug bash. Recording surfaced (and fixed) a real pause→delete UPDATING race by adding a settle() before delete. Goldens now show the caller-supplied role; no AgentCoreOnlineEval-* provisioned role, no IAM (GetRole/PutRolePolicy) fixtures. Verified no agentcore_cli_online_eval* residue in the account afterward.
• Offline replay green: online-eval 25/25, online-insight 19/19 (untouched). Full suite 1751/1751.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.48%. Comparing base (e51a676) to head (ca0ec02).

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2070      +/-   ##
============================================
+ Coverage     97.36%   97.48%   +0.11%     
============================================
  Files           424      423       -1     
  Lines         25571    25261     -310     
============================================
- Hits          24897    24625     -272     
+ Misses          674      636      -38     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

is this vision here that we'll come back to support automatic role creation once we have a general solution for imperative?

[jariy17]

| is this vision here that we'll come back to support automatic role creation once we have a general solution for imperative?

Yes, but after today's standup. I'll leave this feature for now and implement automatic role creation later.