Add imperative AgentCore Payments commands

## Description

Add project-free AgentCore Payments commands to the imperative CLI on `refactor`, following the
existing Handler/Core and ID-based resource-selection conventions.

Deliver the headless surface as two dependent PRs:

1. Read-only commands: get/list for payment managers, connectors, sessions, instruments, and
Identity payment credential providers, plus instrument balance.
2. Mutation commands: create/update/delete where supported, including Coinbase Quick Create,
credential input validation, and optional default service-role provisioning.

Session and instrument commands accept a manager ID. Core resolves the manager ARN with
GetPaymentManager before calling the data plane. Balance requires an explicit chain, defaults
to USDC, preserves atomic amount strings and decimals, and does not convert service errors to zero.

## Acceptance Criteria

- Both PRs independently build and pass their tests.
- Read-only commands do not depend on new mutation handlers or IAM provisioning.
- SDK calls remain in Core, using injected clients and the shared command/test infrastructure.
- The mutation PR preserves the complete headless command behavior.
- CLI-only routes are clearly distinguished from TUI screens.

Read-only/interactive TUI screens are a later, separate PR. Payment execution, runtime payment-token
retrieval, and a generic tagging command are outside this issue.

Start with the imperative CLI and its existing Handler/Core and ID-based resource-selection conventions, then review the shared command and test infrastructure. Separate the read-only and mutation command surfaces, keeping SDK calls in Core and distinguishing CLI routes from later TUI screens. Done means both dependent PRs independently build and pass their tests while preserving the stated headless behavior.

Written by the indexing model from the issue text.