project build: skip STS GetCallerIdentity when every deployment target already has an account

Inizia in lib/schemas/io/config-io.ts nella libreria construct e riproduci il caso AWS_PROFILE con account espliciti in aws-targets.json. Controlla resolveRegionFallback() nello stesso metodo, poi verifica il pin in src/assets/cdk/package.json ed esegui scripts/sync-template-cdk.mjs insieme a src/assets/tests/cdk-schema-compat.test.ts. È completato quando i targets completamente popolati non attivano STS durante la build.

agentcore project build is meant to be fully offline: it runs cdk synth only, and every stack's environment comes from agentcore/aws-targets.json. It currently isn't, when AWS_PROFILE is set.

Found by @aidandaly24 in review of #1970 (comment):

Non-blocking and fine as a follow-up: synthesis succeeds without credentials, but AWS_PROFILE currently causes the pinned ConfigIO.readAWSDeploymentTargets() to call STS even when every target already has an account. I confirmed this by redirecting STS locally. The build still succeeded, but made six GetCallerIdentity attempts and inherited the retry latency. Could we avoid that fallback when account values are already present so build is fully offline?

Cause

In @aws/agentcore-cdk@0.1.0-alpha.45, lib/schemas/io/config-io.ts:

// Only resolve account for targets that don't already have one saved
if (process.env.AWS_PROFILE) {
  const account = await detectAwsAccount();   // <-- STS GetCallerIdentity
  if (account) {
    targets = targets.map(t => (t.account ? t : { ...t, account }));
  }
}

The t.account ? t : ... guard is applied to the result. The STS call itself is gated only on AWS_PROFILE being set, so it fires even when it cannot change anything. detectAwsAccount() swallows failures, which is why the build still succeeds — but the SDK's default retry policy is paid first (the six attempts Aidan measured).

Suggested fix

Hoist the guard so the call is skipped when it would be a no-op:

if (process.env.AWS_PROFILE && targets.some(t => !t.account)) {
  ...
}

Worth reviewing resolveRegionFallback() in the same method too — it reads shared config files rather than calling a service, so it's cheap, but it runs unconditionally for the same reason.

Notes

• The fix lives in the construct library (@aws/agentcore-cdk), not this CLI. Landing it here is then a version bump of the exact pin in src/assets/cdk/package.json (currently 0.1.0-alpha.45), which scripts/sync-template-cdk.mjs and src/assets/__tests__/cdk-schema-compat.test.ts cover.
• No CLI-side workaround is needed in the meantime: build still succeeds, it's latency plus an unnecessary credential dependency.
• Repro: set AWS_PROFILE, fill in aws-targets.json with explicit account values, blackhole sts.*.amazonaws.com, then run agentcore project build.

cc @notgitika