project build: skip STS GetCallerIdentity when every deployment target already has an account

`agentcore project build` is meant to be fully offline: it runs `cdk synth` only, and every stack's environment comes from `agentcore/aws-targets.json`. It currently isn't, when `AWS_PROFILE` is set.

Found by @aidandaly24 in review of #1970 ([comment](https://github.com/aws/agentcore-cli/pull/1970#discussion_r3770161762)):

> Non-blocking and fine as a follow-up: synthesis succeeds without credentials, but `AWS_PROFILE` currently causes the pinned `ConfigIO.readAWSDeploymentTargets()` to call STS even when every target already has an account. I confirmed this by redirecting STS locally. The build still succeeded, but made six `GetCallerIdentity` attempts and inherited the retry latency. Could we avoid that fallback when account values are already present so build is fully offline?

## Cause

In `@aws/agentcore-cdk@0.1.0-alpha.45`, `lib/schemas/io/config-io.ts`:

```ts
// Only resolve account for targets that don't already have one saved
if (process.env.AWS_PROFILE) {
const account = await detectAwsAccount(); // <-- STS GetCallerIdentity
if (account) {
targets = targets.map(t => (t.account ? t : { ...t, account }));
}
}
```

The `t.account ? t : ...` guard is applied to the *result*. The STS call itself is gated only on `AWS_PROFILE` being set, so it fires even when it cannot change anything. `detectAwsAccount()` swallows failures, which is why the build still succeeds — but the SDK's default retry policy is paid first (the six attempts Aidan measured).

## Suggested fix

Hoist the guard so the call is skipped when it would be a no-op:

```ts
if (process.env.AWS_PROFILE && targets.some(t => !t.account)) {
...
}
```

Worth reviewing `resolveRegionFallback()` in the same method too — it reads shared config files rather than calling a service, so it's cheap, but it runs unconditionally for the same reason.

## Notes

- The fix lives in the **construct library** (`@aws/agentcore-cdk`), not this CLI. Landing it here is then a version bump of the exact pin in `src/assets/cdk/package.json` (currently `0.1.0-alpha.45`), which `scripts/sync-template-cdk.mjs` and `src/assets/__tests__/cdk-schema-compat.test.ts` cover.
- No CLI-side workaround is needed in the meantime: build still succeeds, it's latency plus an unnecessary credential dependency.
- Repro: set `AWS_PROFILE`, fill in `aws-targets.json` with explicit `account` values, blackhole `sts.*.amazonaws.com`, then run `agentcore project build`.

cc @notgitika

Start in lib/schemas/io/config-io.ts in the construct library and reproduce the AWS_PROFILE case with explicit accounts in aws-targets.json. Check resolveRegionFallback() in the same method, then review the pin in src/assets/cdk/package.json and run scripts/sync-template-cdk.mjs plus src/assets/__tests__/cdk-schema-compat.test.ts. Done means fully populated targets do not trigger STS during build.

Written by the indexing model from the issue text.