Provision AWS infrastructure for selected agents

Prerequisites

• .sdlc-agents/selection.yaml exists and lists the agents, AWS account ID, region, and stage
• The user's current AWS credentials can reach the target account (aws sts get-caller-identity shows the right account)
• Bedrock model access is enabled for the Opus 4.7 cross-region inference profile in the target region (check: aws bedrock get-inference-profile --inference-profile-identifier us.anthropic.claude-opus-4-7 --region $REGION). If the call 404s, stop and tell the user to request access in the Bedrock console before continuing.
• The shared foundation stack (infra/foundation/template.yaml → sdlc-agents-${STAGE}) is deployed. Check by listing the stack; deploy with SAM if missing.

Step 0 — OIDC provider and deploy role (one-time per AWS account)

The foundation stack does not create the GitHub Actions OIDC provider or the deploy role — docs/aws-deploy.md §1.3 is the source of truth on this. You create them by hand here the first time the fleet is set up in a given AWS account. Skip this step if the account already has both (common when a different repo in the org previously onboarded).

0a. OIDC provider