feat: add protected AgentCore evaluation provider parity

[afaryy]

Summary

• adds Stage A source only; no AWS evaluation occurred
• keeps required PR CI cloud-free and adds a protected manual six-call lane
• adds an evaluate-only OIDC role source; it has not been applied
• emits only metadata-safe provider-direct evidence

Validation

• full API tests
• local deterministic evaluation gate
• cloud-free provider-parity validate mode
• Ruby IAM boundary tests and cfn-lint

Pending approvals

Provider validation, bootstrap plan/apply, environment handoff, and Stage B Runtime-to-CloudWatch evaluation remain pending. Do not merge without explicit approval.