feat(gateway): add headless invoke command

[aidandaly24]

Summary

• add agentcore gateway invoke as a headless, project-independent command with GET, POST, and DELETE support
• resolve the data-plane URL and authorizer from GetGateway, including SigV4, bearer-token, and unsigned requests
• support relative paths with query strings, source-aware payloads and tokens, application/session headers, and raw, file, or JSON response output
• redact path, payload, application-header, and bearer-token values from command debug logs
• preserve 3xx/4xx/5xx response bodies in the selected output mode, then return a failure exit for non-2xx responses
• sign AUTHENTICATE_ONLY requests with SigV4, matching live service behavior
• share the streaming response writer with Runtime invoke while preserving Runtime behavior
• keep the V1 surface raw: no TUI, --request-type, structured --query, or discovery commands

Validation

• bun test: 1,087 passed, 0 failed on current refactor
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build

Live Gateway validation

Using AWS_PROFILE=deploy in account 603141041947:

• Ingress NONE: HTTP 200 with file/stdin payloads and raw/JSON/file output
• Ingress AWS_IAM: HTTP 200 with SigV4 and repeated query keys
• Ingress CUSTOM_JWT: HTTP 200 with inline/file/stdin bearer-token sources
• Ingress AUTHENTICATE_ONLY: HTTP 200 with SigV4 through the CLI; --bearer-token is rejected locally
• Outbound API key: successful API Gateway MCP target invocation
• Outbound OAuth 2LO: successful CLIENT_CREDENTIALS MCP target invocation
• Outbound OAuth 3LO: Cognito authorization-code consent, CompleteResourceTokenAuth session binding, and successful per-user tool call with downstream user-token evidence
• Outbound OBO: RFC 8693 token exchange and successful OpenAPI tool call with a distinct opaque obo.* downstream token
• JWT passthrough: backend token hash exactly matched the scoped Cognito caller-token hash
• Gateway IAM role: successful AgentCore Runtime HTTP target invocation with Runtime session and SSE body
• Inference: 47 models discovered through v1/models; OpenAI-compatible chat completion returned inference gateway ready
• HTTP 405 response: preserved Method Not Allowed in raw and JSON output, then exited 1 without duplicate stderr
• query-secret redaction probe: the secret had zero log matches and the execution record stored path: [REDACTED]

The reusable matrix and retry commands are documented at gateway-invoke/auth-matrix/README.md in the task workspace.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 99.13793% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.94%. Comparing base (9398c03) to head (d40be7e).
⚠️ Report is 1 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/gateway/invoke/request.ts	96.77%	5 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #1967      +/-   ##
============================================
+ Coverage     96.91%   96.94%   +0.02%     
============================================
  Files           356      360       +4     
  Lines         20136    20596     +460     
============================================
+ Hits          19515    19966     +451     
- Misses          621      630       +9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nborges-aws]

LGTM thanks for fixes!

[tejaskash]

👍