[Feature Request] Support configuring a custom IAM permissions boundary for generated roles

### Description

Please add first-class support for attaching a **custom IAM permissions boundary** to every IAM role that AgentCore generates during `agentcore deploy`.

Many enterprise and partner AWS accounts enforce an **organization-managed permissions boundary** on all IAM principals. A common form of this guardrail is an explicit `Deny` on `iam:CreateRole` **unless the new role attaches a specific policy as its own permissions boundary**.

In such accounts, `agentcore deploy` fails at role creation. Example error when deploying a project with a single harness:

```
User: arn:aws:sts:::assumed-role/cdk-hnb659fds-cfn-exec-role--/AWSCloudFormation
is not authorized to perform: iam:CreateRole
on resource: arn:aws:iam:::role/_
with an explicit deny in a permissions boundary: arn:aws:iam:::policy/
(Status Code: 403; HandlerErrorCode: UnauthorizedTaggingOperation)
```

The generated roles have **no `PermissionsBoundary` property**, so CloudFormation's `iam:CreateRole` call is denied and the whole stack rolls back. There is currently **no supported configuration** (CLI flag, `aws-targets.json` field, env var, or `agentcore.json` field) to inject a boundary.

I confirmed the root cause is the "must attach boundary on create" rule (creating a probe role *with* the boundary succeeds; *without* it 403s). I patched the generated `bin/cdk.ts` to apply an App-wide boundary via the CDK IAM aspect:

```ts
import * as iam from 'aws-cdk-lib/aws-iam';

iam.PermissionsBoundary.of(app).apply(
iam.ManagedPolicy.fromManagedPolicyArn(
app,
'OrgPermissionsBoundary',
'arn:aws:iam:::policy/'
)
);
```

This makes the deploy succeed (stack reaches `CREATE_COMPLETE`), but it is **not viable long-term** because `agentcore deploy` re-materializes the `cdk/` directory from CLI templates and **overwrites the patch**. I must deploy via raw `cdk deploy` instead, which leaves AgentCore's local state (`.cli/deployed-state.json`) out of sync.

### Acceptance Criteria

- When configured, **every** generated IAM role (harness/runtime execution roles, and any L3-created roles) is synthesized with the specified `PermissionsBoundary`.
- Works through the standard `agentcore deploy` flow with **no manual edits** to generated `cdk/` files.
- Survives `cdk/` regeneration/materialization.
- No boundary is applied when the setting is absent (backward compatible).

### Additional Context

- `@aws/agentcore` CLI: `0.28.1`
- CDK (bundled): `2.1126.0`
- Node.js: `22.x`
- Deploy target: single-harness project, `PYTHON` runtime, region ``

Start by tracing the generated bin/cdk.ts entry point through the CLI template and cdk/ materialization flow used by agentcore deploy. Check how harness and runtime roles are synthesized, then verify that a configured boundary reaches every generated or L3-created role, is absent by default, and survives regeneration and deployment.

Written by the indexing model from the issue text.