Amazon Bedrock AgentCore Samples – [Proposal] Add Okta-Authenticated MCP Server on AgentCore Runtime

**Background**

The `05-authenticate-and-authorize` section covers Okta inbound auth for agent
runtimes and Entra ID + MCP, but has no sample combining **Okta JWT validation
with an MCP server**. This is a common pattern for Okta-based organizations
that want AgentCore to handle auth without any auth logic inside the server.

**Proposal**

Add `05-okta-mcp-runtime/` containing:

- **FastMCP server** wrapping a Bedrock Knowledge Base (`query_knowledge_base` tool)
- **Deploy/invoke/cleanup script** (boto3) — Docker build, ECR push, IAM role,
runtime with `customJWTAuthorizer`, PKCE OAuth test flow
- **Okta setup guide** — Custom Authorization Server, Native Application,
`client_id` claim mapping (a common stumbling block with AgentCore)
- **MCP client config** for Claude Code and Cursor

Simpler than `04-entra-obo-mcp-runtime` (single runtime, no OBO, no credential
provider). Follows the same boto3 orchestration pattern.

**Acceptance Criteria**

- `python okta_mcp_runtime.py` deploys, tests (401 for unauth, KB answers for
auth), and prints client config
- `python okta_mcp_runtime.py --cleanup` tears down all resources
- README covers prerequisites, setup, troubleshooting, and client compatibility

Start by reading the 05-authenticate-and-authorize section and the 04-entra-obo-mcp-runtime example to understand the existing orchestration pattern. Design the proposed 05-okta-mcp-runtime/ sample around okta_mcp_runtime.py, then verify that deployment and invocation produce the specified unauthenticated and authenticated results, cleanup removes resources, and the README includes setup, troubleshooting, and client compatibility guidance.

Written by the indexing model from the issue text.