agentcore: L2 constructs don't set node.defaultChild, breaking applyRemovalPolicy

I noticed this while fixing #38262, and I am posting it as a tracking issue because the problem is not isolated to Memory.

Most of the bedrockagentcore L2 constructs create their Cfn resource plus at least one other child (usually a ServiceRole). Because of that, CDK never auto-assigns the Cfn resource as node.defaultChild, and calling applyRemovalPolicy() on the L2 throws:

CannotApplyRemovalPolicy: Cannot apply RemovalPolicy: no child or not a CfnResource.

This affects the following constructs (from a quick scan of packages/aws-cdk-lib/aws-bedrockagentcore/lib):

- tools/browser.ts
- tools/code-interpreter.ts
- memory/memory.ts (fixed in #38313)
- identity/workload-identity.ts
- identity/oauth2-credential-provider.ts
- identity/api-key-credential-provider.ts
- runtime/runtime.ts
- runtime/runtime-endpoint.ts
- evaluation/online-evaluation.ts
- evaluation/custom-evaluator.ts
- gateway/gateway.ts
- gateway/targets/target.ts
- observability.ts (creates several Cfn children)

The fix is the same one-liner in each case: assign this.node.defaultChild = this.__resource (or whatever the Cfn field is) right after constructing it, matching how s3.Bucket and dynamodb.Table do it.

I have done Memory in #38313. I am happy to work through the rest if that is okay, or anyone else can grab individual ones. I thought a single tracking issue was better than opening twelve separate ones.

## Progress

- [x] memory/memory.ts (fixed in #38282, #38313 closed in favor of it)
- [x] runtime/runtime.ts (fixed in #38328)
- [x] gateway/gateway.ts (fixed in #38329)
- [ ] tools/browser.ts
- [ ] tools/code-interpreter.ts
- [ ] identity/workload-identity.ts
- [ ] identity/oauth2-credential-provider.ts
- [ ] identity/api-key-credential-provider.ts
- [ ] runtime/runtime-endpoint.ts
- [ ] evaluation/online-evaluation.ts
- [ ] evaluation/custom-evaluator.ts
- [ ] gateway/targets/target.ts
- [ ] observability.ts

I will work through the remaining ones as separate small PRs so each is easy to review.

Start in packages/aws-cdk-lib/aws-bedrockagentcore/lib and inspect the unchecked files listed in the issue, comparing their Cfn resource construction with s3.Bucket and dynamodb.Table. Confirm each affected L2's applyRemovalPolicy behavior; the work is done when the remaining constructs set the correct default child and no longer throw CannotApplyRemovalPolicy.

Written by the indexing model from the issue text.