feat(payments): add Quick Create connector flow

[aidandaly24]

Description

Adds PaymentConnector Quick Create support across the AgentCore CLI, TUI, vended CDK app, deployment state, and status experience.

• Models manual and Quick Create connectors as distinct schema variants while preserving existing manual configuration.
• Adds --provision-mode QUICK_CREATE and a recommended Quick Create TUI option.
• Skips local secret collection, credential entries, .env.local payment variables, credential predeploy, and imperative provider cleanup for Quick Create.
• Maps Quick Create to ProvisionMode: QUICK_CREATE with CredentialProviderConfigurations: [].
• Reads GetPaymentConnector after deployment and in status, showing the live authorization URL only while authentication is pending.
• Keeps authorization URLs out of deployed state, deploy logs, and stale CFN output rendering.
• Preserves manual Coinbase CDP and Stripe + Privy behavior.

This draft depends on https://github.com/aws/agentcore-l3-cdk-constructs/pull/324. Before merge, the vended CDK dependency must be updated from the current published version to the new L3 alpha containing that PR.

Related Issue

N/A. This feature is coordinated with the dependent L3 PR above.

Documentation PR

Documentation is included in this PR.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Additional verification:

• Full unit suite: 425 files, 6,117 tests passed.
• Full integration suite: 34 files, 342 passed, 1 skipped.
• Dedicated Quick Create TUI harness: 4 tests passed.
• Lint: 0 errors; existing repository warnings only.
• Format, documentation tests, and secretlint passed.
• npm run bundle produced an installable CLI with the sibling L3 feature branch embedded.
• Isolated installation reported 0.27.0-quick-create and installed L3 0.1.0-alpha.47-quick-create.
• Bundled synth emitted the exact Quick Create CFN shape and the expected status/authorization outputs.
• Bundled live deployment in ap-southeast-2 reached CREATE_COMPLETE and PENDING_AUTHENTICATION.
• Live deploy output and agentcore status returned the current authorization URL through GetPaymentConnector.
• After Coinbase consent, live GetPaymentConnector returned READY, omitted the authorization URL, and returned the generated credential provider ARN.
• The existing repo-wide TUI suite has unrelated stale navigation failures in lifecycle/gateway/memory tests; the new Payments TUI test passes.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.27.0.tgz

How to install

gh release download pr-2017-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.27.0.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[nborges-aws]

If this state is hit, would deploying again actually work? Unless we are issuing a fresh authorization URL, it would just fail again with the same stale URL