feat: Identity — JWT Federation Lifecycle

## Problem

The SDK's `IdentityClient` lets customers exchange tokens and manage credential providers at runtime, but the IAM prerequisites that make these features work have no SDK support. Before `@requires_access_token`, `@requires_iam_access_token`, or `get_token()` can function, customers must:

1. Enable AWS IAM Outbound Web Identity Federation at the account level — an obscure one-time IAM API call (`enable_outbound_web_identity_federation`) that isn't documented alongside the SDK's identity features
2. Configure the agent's execution role with the correct trust policy (`bedrock-agentcore.amazonaws.com` as trusted principal) and inline policies for workload token exchange, Secrets Manager access, and JWT signing permissions

Without this, customers follow the SDK docs, try `@requires_access_token`, get cryptic auth failures, and have to reverse-engineer the IAM setup themselves. The starter toolkit automates this with `setup_aws_jwt_federation()` and `ensure_identity_permissions()` — the SDK should provide the same so that identity features work out of the box.

## Acceptance Criteria

- [ ] Customers can enable AWS IAM Outbound Web Identity Federation (idempotent)
- [ ] Customers can check whether JWT federation is enabled and retrieve the issuer URL
- [ ] Customers can configure execution role trust policies and inline policies for identity flows
- [ ] Customers can configure execution role permissions for AWS JWT signing with audience/algorithm/duration conditions
- [ ] All functionality is verified via integration tests running in CI

## Relevant Links

- [`setup_aws_jwt_federation()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L360)
- [`get_aws_jwt_federation_info()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L424)
- [`ensure_identity_permissions()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L257)
- [`ensure_aws_jwt_permissions()`](https://github.com/aws/bedrock-agentcore-starter-toolkit/blob/4b9387f0d48cb6639633437b669fc6cc09ef07be/src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py#L454)

Inizia dai punti di ingresso per lo scambio di token e per il credential provider di IdentityClient, quindi confrontali con gli helper indicati in src/bedrock_agentcore_starter_toolkit/operations/identity/helpers.py: setup_aws_jwt_federation(), get_aws_jwt_federation_info(), ensure_identity_permissions() e ensure_aws_jwt_permissions(). Definisci la superficie dell’SDK e la copertura dei test di integrazione per la configurazione idempotente della federazione, la ricerca dell’issuer, le policy dei ruoli e le condizioni di firma JWT; il lavoro è completato quando tutti i criteri di accettazione passano in CI.

Scritto dal modello di indicizzazione a partire dal testo della issue.