01-features - [Bug] 05-authenticate-and-authorize/01-inbound-auth/03-inbound-auth-okta undeployable

## Bug Description

Both Python scripts under `01-features/05-authenticate-and-authorize/01-inbound-auth/03-inbound-auth-okta/` fail to deploy end-to-end on a clean AWS account:

- Both `okta_inbound_auth.py` and `okta_gateway_auth.py` are rejected at `create_agent_runtime` - `codeConfiguration` is passed at the top level of the request instead of being nested inside `agentRuntimeArtifact`, and the call is missing the required `runtime` and `entryPoint` fields.
- Dependencies listed in `requirements.txt` are never installed into the deployment zip (an empty `BytesIO` is uploaded), so the runtime crashes on boot with `ModuleNotFoundError: No module named 'bedrock_agentcore'`
and trips the 30s init timeout.
- IAM role propagation race causes intermittent `ValidationException: role not assumable` on `create_agent_runtime`; no retry is in place.
- `bedrock:InvokeModel` resource is scoped to `foundation-model/*` only, so the embedded agent (which uses `global.anthropic.claude-haiku-4-5` — a cross-region inference profile) gets `AccessDeniedException` on first invoke. `bedrock:Converse` and `bedrock:ConverseStream` actions are also missing.
- `okta_gateway_auth.py` additional issues:
- `oauthCredentialProvider` is passed at the top of the request instead of being nested inside the `credentialProvider` wrapper required by the API schema.
- The created OAuth credential provider's ARN isn't threaded through to `create_gateway`; the script reads it from an env var that's never set.
- The Lambda gateway target is configured with the OAuth credential provider type, but Lambda targets only accept `GATEWAY_IAM_ROLE` per the AgentCore API contract.
- `create_gateway_target` is called immediately after `create_gateway`, racing with the gateway's `CREATING` status: `Cannot perform operation CreateGatewayTarget when gateway is in CREATING status`.
- `MCPClient` is used with `start()`/`stop()` instead of the documented context-manager form.
- Cleanup tries to delete the gateway before its targets are removed: `gateway has targets associated with it`.

PR forthcoming.

Start with 01-features/05-authenticate-and-authorize/01-inbound-auth/03-inbound-auth-okta/okta_inbound_auth.py and okta_gateway_auth.py, then inspect requirements.txt and the create_agent_runtime and gateway API calls. Validate the deployment flow on a clean AWS account, including dependency installation, IAM propagation, authorization, gateway creation and cleanup; done means both scripts deploy and run end-to-end without the reported errors.

Written by the indexing model from the issue text.