feat: Identity — JWT Federation Lifecycle

## Problem

The SDK's `IdentityClient` lets customers exchange tokens and manage credential providers at runtime, but the IAM prerequisites that make these features work have no SDK support. Before `@requires_access_token`, `@requires_iam_access_token`, or `get_token()` can function, customers must:

1. Enable AWS IAM Outbound Web Identity Federation at the account level — an obscure one-time IAM API call (`enable_outbound_web_identity_federation`) that isn't documented alongside the SDK's identity features
2. Configure the agent's execution role with the correct trust policy (`bedrock-agentcore.amazonaws.com` as trusted principal) and inline policies for workload token exchange, Secrets Manager access, and JWT signing permissions

Without this, customers follow the SDK docs, try `@requires_access_token`, get cryptic auth failures, and have to reverse-engineer the IAM setup themselves. The starter toolkit automates this with `setup_aws_jwt_federation()` and `ensure_identity_permissions()` — the SDK should provide the same so that identity features work out of the box.

## Acceptance Criteria

- [ ] Customers can enable AWS IAM Outbound Web Identity Federation (idempotent)
- [ ] Customers can check whether JWT federation is enabled and retrieve the issuer URL
- [ ] Customers can configure execution role trust policies and inline policies for identity flows
- [ ] Customers can configure execution role permissions for AWS JWT signing with audience/algorithm/duration conditions
- [ ] All functionality is verified via integration tests running in CI

## Relevant Links

- [`setup_aws_jwt_federation()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L360)
- [`get_aws_jwt_federation_info()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L424)
- [`ensure_identity_permissions()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L257)
- [`ensure_aws_jwt_permissions()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L454)

Comienza con los puntos de entrada de intercambio de tokens y del proveedor de credenciales de IdentityClient, y compáralos después con los helpers referenciados en src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py: setup_aws_jwt_federation(), get_aws_jwt_federation_info(), ensure_identity_permissions() y ensure_aws_jwt_permissions(). Define la superficie del SDK y la cobertura de las pruebas de integración para una configuración idempotente de la federación, la búsqueda del issuer, las políticas de roles y las condiciones de firma de JWT; se considera terminado cuando todos los criterios de aceptación pasan en CI.

Escrito por el modelo de indexación a partir del texto del issue.