Add Bedrock and SageMaker idle capacity rules

What

Rules for idle ML capacity: Bedrock provisioned throughput with no invocations, and SageMaker Studio apps left running.

Why

Bedrock provisioned throughput (provisioned model units) is among the most expensive idle capacity on AWS today. Commitments run thousands of dollars per month per model unit whether invoked or not, and this is increasingly common as teams experiment with GenAI. SageMaker Studio kernel and app instances left running are the Studio-era version of the notebook-instance waste that CLDBRN-AWS-SAGEMAKER-1 already flags.

Details

1. Bedrock provisioned throughput with zero or negligible invocations over the lookback window. Discovery only; new bedrock/ module, CLDBRN-AWS-BEDROCK-1. Confirm Resource Explorer support for provisioned model throughput. If it is unsearchable, use an account-level dataset per the existing costguardrails pattern instead of a new Region fan-out.
2. SageMaker Studio app (KernelGateway, JupyterServer, or CodeEditor) in InService beyond an idle threshold. Discovery only; extends sagemaker/ as CLDBRN-AWS-SAGEMAKER-4. CLDBRN-AWS-SAGEMAKER-3 is assigned to Savings Plans coverage in #200.
3. Optional: SageMaker endpoint on a real-time instance whose traffic fits serverless inference. Review severity; define the boundary with CLDBRN-AWS-SAGEMAKER-2 during research.

Review the existing costguardrails pattern and CLDBRN-AWS-SAGEMAKER-1 in the sagemaker/ module. Confirm whether Resource Explorer can discover Bedrock provisioned throughput; otherwise use the account-level dataset pattern, then extend sagemaker/ for idle InService Studio apps. Done means discovery-only rules for CLDBRN-AWS-BEDROCK-1 and CLDBRN-AWS-SAGEMAKER-4, with the optional endpoint case bounded against CLDBRN-AWS-SAGEMAKER-2.