Agent: split agent.py into a package with a toolkit per AWS service

[utkarsh5026]

agent.py held the Lambda tools, the read-only guard, the budget, the Azure
model, the deepagents loop and the report in one 1,576-line file, so adding
another service's tools or a new agent capability meant touching all of it.
It's now aws_analyzer/agent/, one concern per module:

toolkits/ a Toolkit per AWS service (base.py: what one gives; the
Lambda tools and their summarize_* in lambda_tools.py;
TOOLKITS and DEFAULT_TOOLKITS in init.py)
runtime.py how any tool runs: budget first, call recorded, errors
turned into its result
guard.py the read-only guard, now also hooking an analyzer's main
client when it's set in init
budget.py Budget, the question's _Run and check_budget()
results.py what tools hand the model (JSON, UTC windows, secrets
hidden, permissions named)
prompt.py shared rules, then each toolkit's section, then how to answer
llm.py the Azure OpenAI model, its name, cost and errors
harness.py deepagents built once, and one question streamed through it
answers.py AgentAnswer, ToolCall, answer_findings, answer_next
analyzer.py AgentAnalyzer; view.py AgentView

AgentAnalyzer(toolkits=[...]) takes names, Toolkit subclasses or objects,
so a new service is one module plus a line in TOOLKITS. Tool names,
signatures, docstrings and reads are unchanged, and the tools() and help()
reports are byte-identical; the system prompt keeps its sentences but groups
the Lambda advice into its own section.

The checks now understand an analyzer that is a package: rules.py reads
relative imports from the module's own package and wants a View in one of
its modules, and CI, run.py, test_package.py, demo.py and snapshot.py list
packages beside *.py files.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_019x2akVBnfNNM59KqSrnGS8