Add Amazon Bedrock Managed Knowledge Base as an AgentCore Gateway connector (agentic RAG) with per-tenant access control

## Summary

Add **Amazon Bedrock Managed Knowledge Bases** as an AgentCore Gateway built-in connector (announced GA at AWS Summit New York 2026) to provide fully managed retrieval-augmented generation (RAG). The connector exposes two MCP tools, discoverable via `tools/list`:

- **`AgenticRetrieveStream`** — multi-step agentic retrieval: plans a retrieval strategy, runs multiple retrieval steps, optionally expands to full documents, and streams back supporting results plus a synthesized, citation-backed answer.
- **`Retrieve`** — a single hybrid search returning the most relevant passages with source references.

This augments (and is a candidate successor to) the existing custom Lambda-based KB tool.

## Background / Motivation

- The agent today retrieves from a knowledge base via a custom Lambda tool:
- `packages/lambda-tools/tools/kb-tools/` (`src/tools/kb-retrieve.ts`)
- Target wiring: `packages/cdk/lib/agentcore-gateway-target-stack.ts`
- The managed connector removes the need to maintain custom retrieval glue: Amazon Bedrock manages the vector store, ingestion, and retrieval optimization. `AgenticRetrieveStream` adds multi-step planning and a synthesized, citation-backed answer that the current single-lookup `kb-retrieve` does not provide.
- The agent's existing MCP plumbing can consume the connector tools with little or no agent code change.

## Constraints / Known limitations

- The connector is supported **only for Amazon Bedrock Managed Knowledge Bases**.
- **Region availability** for the deployment region (e.g. `ap-northeast-1`) MUST be confirmed before enabling.
- **Access control is not automatic**: the Gateway does **not** derive `userContext` from the caller's IAM identity. The application MUST pass `userContext` explicitly for per-user/per-group filtering to apply.

## Requirements (EARS)

- The system shall allow attaching an Amazon Bedrock Managed Knowledge Base to the AgentCore Gateway as a connector target, referencing a configurable knowledge base id.
- Where a Managed Knowledge Base target is configured, the agent shall be able to invoke `Retrieve` and `AgenticRetrieveStream` via MCP.
- When the agent issues a retrieval, the system shall return passages and (for `AgenticRetrieveStream`) a synthesized answer that retains source citations.
- **(Multi-tenancy — critical)** While serving a request, the system shall inject a `userContext` (e.g. `userContext.userId` = the authenticated Cognito `sub`) into every Managed KB tool call so that per-user/per-group access-control filtering is enforced.
- If a Managed KB tool call would be made without a valid `userContext` while access control is required, then the system shall block the call (fail closed) to prevent cross-tenant data exposure.
- The administrator-set knowledge base id and retrieval settings shall not be overridable by the agent unless explicitly exposed via `parameterOverrides`; `userContext` shall **not** be exposed to the agent/LLM.

## Proposed approach (non-binding)

- **CDK**: in `packages/cdk/lib/agentcore-gateway-target-stack.ts`, add a Gateway target for the Managed KB connector via L1 `AWS::BedrockAgentCore::GatewayTarget` (`CfnGatewayTarget`), referencing a `managedKnowledgeBaseId` added to `packages/cdk/config/environment-types.ts` / `environments.ts`.
- **IAM**: grant the Gateway Service Role least-privilege `bedrock:Retrieve` / `bedrock:RetrieveAndGenerate` on the target KB; ensure the CDK deploy role has `iam:CreateServiceLinkedRole` for AgentCore service-linked roles.
- **Tenant isolation**: extend the existing Gateway interceptor Lambda (`packages/cdk/lambda/gateway-interceptor/index.ts`) so that, for Managed KB tool calls, it injects `userContext.userId` from the authenticated Cognito `sub`. Do **not** expose `$.userContext` via `parameterOverrides`. Design KB-side metadata so access-control filtering keys off `userContext.userId`, consistent with the app's existing per-identity isolation model (`dynamodb:LeadingKeys`).
- **Agent**: existing MCP discovery (`mcp-clients-builder.ts` → `mcp-converter.ts` → `tools-builder.ts`) should surface the tools; verify tool naming in `packages/libs/tool-definitions/src/tool-names.ts`.
- Keep the existing `kb-tools` Lambda target runnable in parallel during evaluation; consider consolidating once the managed connector is validated.

## Acceptance criteria

- [ ] A Managed KB target can be provisioned via CDK using a configurable `managedKnowledgeBaseId`.
- [ ] The agent can call both `Retrieve` and `AgenticRetrieveStream` and receive citation-backed results.
- [ ] For every Managed KB call, `userContext.userId` is injected server-side from the Cognito `sub` and is **not** settable by the agent/LLM.
- [ ] A request without a valid `userContext` (when ACL is required) is blocked (fail closed); a test demonstrates no cross-tenant leakage.
- [ ] The Gateway Service Role has least-privilege `bedrock:Retrieve` / `bedrock:RetrieveAndGenerate`; the deploy role has `iam:CreateServiceLinkedRole`.
- [ ] Region availability is confirmed for the deployment region before enabling.
- [ ] README / docs updated; relationship to the existing `kb-tools` Lambda documented.

## Out of scope

- Web Search Tool integration (tracked in #54).
- Knowledge base content ingestion / data-source setup beyond referencing an existing Managed Knowledge Base.

## References

- New in Amazon Bedrock AgentCore: Build agents with broader knowledge and continuous learning (AWS AI Blog): https://aws.amazon.com/blogs/machine-learning/new-in-amazon-bedrock-agentcore-build-agents-with-broader-knowledge-and-continuous-learning/
- AgentCore Gateway — Managed Knowledge Bases as connector target (Developer Guide): https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-connectors.html
- CloudFormation `AWS::BedrockAgentCore::GatewayTarget`: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-gatewaytarget.html

Start by reading packages/cdk/lib/agentcore-gateway-target-stack.ts, packages/cdk/config/environment-types.ts, environments.ts, and packages/cdk/lambda/gateway-interceptor/index.ts. Trace MCP discovery through mcp-clients-builder.ts, mcp-converter.ts, tools-builder.ts, and packages/libs/tool-definitions/src/tool-names.ts. Done means the configurable target, both tools, server-side fail-closed userContext injection, least-privilege permissions, region check, tests, and documentation are complete.

Written by the indexing model from the issue text.