feat: no way to update gateway configuration within a harness after initial creation

[aidandaly24]

Description

When adding a gateway tool to a harness during the agentcore add harness flow, the gateway configuration (ARN, outbound auth type, OAuth provider ARN, scopes) is written to app/<harnessName>/harness.json and cannot be modified afterward through the CLI. If a user makes a mistake — wrong gateway ARN, incorrect auth type, missing scopes — they are stuck in a state where deployments fail with no CLI-native way to resolve it.

This is specifically about harness-level gateway tools, not standalone gateways. Standalone gateways (agentcore add gateway) are stored in agentcore.json and can be hand-edited by the user. Harness gateway tool configuration lives in a separate file (app/<harnessName>/harness.json) that users may not know exists or how to edit.

Current Behavior

During agentcore add harness, if the user selects agentcore_gateway as a tool, the wizard captures:

• Gateway ARN (gateway-arn step)
• Outbound auth type (gateway-outbound-auth step — awsIam, none, or oauth)
• If OAuth: provider ARN and scopes

This config is written into the harness spec's tools array in app/<harnessName>/harness.json:

{
  "tools": [
    {
      "type": "agentcore_gateway",
      "name": "gateway",
      "config": {
        "agentCoreGateway": {
          "gatewayArn": "arn:aws:bedrock:us-east-1:123456789012:gateway/my-gateway",
          "outboundAuth": {
            "oauth": {
              "providerArn": "arn:aws:...",
              "scopes": ["read", "write"]
            }
          }
        }
      }
    }
  ]
}

After creation, there is no agentcore update harness or similar command. The only workarounds are:

1. Manually edit app/<harnessName>/harness.json (undiscoverable — users don't know this file exists)
2. agentcore remove harness + agentcore add harness (destructive — loses any other customizations)

Expected Behavior

Users should be able to update harness configuration (including gateway tools) after initial creation, e.g.:

agentcore update harness --name <harness-name>

This would re-enter the wizard with current values as defaults, allowing the user to change the gateway ARN, auth config, or any other harness setting.

Relevant Code

• Gateway tool built during harness add: src/cli/primitives/HarnessPrimitive.ts lines 110-138
• Harness spec written: src/cli/primitives/HarnessPrimitive.ts line 177
• Harness spec file path: app/<harnessName>/harness.json (resolved by PathResolver.getHarnessConfigPath())
• Tools passed to API unchanged during deploy: src/cli/operations/deploy/imperative/deployers/harness-mapper.ts lines 248-254
• No update() method on HarnessPrimitive or BasePrimitive

Impact

Users who misconfigure a gateway during the harness creation wizard have no discoverable way to fix it. Deployments fail, and the user must either:

• Know the internal file structure to manually edit harness.json
• Destroy and recreate the entire harness

This is especially painful because gateway ARNs and OAuth provider ARNs are long and easy to typo.

[aidandaly24]

Consolidated into #1102 — both issues are about the inability to edit harness configuration after creation.