Add AWS workforce access and persistent coding environments

[ZILECAO]

Summary

AgentFormation provides private, persistent coding environments inside an organization's AWS account. This change adds the complete workforce experience:

• group-based employee sign-in through AWS IAM Identity Center, bridged to the web app through Cognito
• one subject-bound EC2 runtime per assigned employee, created by a fixed Step Functions job
• a persistent browser terminal with tabs, file uploads, progress reporting, session resume, calmer mouse and trackpad scrolling, touch scrollback, and stable text selection
• a remote OAuth handoff for command-line tools whose browser login finishes on a runtime-local callback
• pinned AWS CLI, Node.js, Bun, Claude Code, and Codex runtime tools
• operator-managed custom web addresses and repeatable deployment checks
• setup, configuration-porting, privacy, security-model, release, and secure local-agent migration guidance

Design boundaries

• AgentFormation keeps no separate employee password and does not add app-specific MFA.
• Browser requests cannot choose an instance, runtime template, IAM role, or deployment parameters.
• Runtime access is bound to the federated Identity Center subject stored in the deployment registry.
• Remote OAuth callbacks accept only strict localhost or 127.0.0.1 URLs and keep one-time codes out of Systems Manager command history.
• Organization-specific AWS metadata remains in ignored local configuration.
• GitHub Actions validate the public project without receiving AWS deployment credentials.

Validation

• all 48 tests passed across 13 test files
• formatting, lint, and TypeScript passed
• production Next.js build and container smoke test passed
• dependency audit found no known vulnerabilities
• ShellCheck, CloudFormation lint, and GitHub Actions lint passed
• documentation links passed offline validation
• complete Git history passed the pinned Gitleaks scan
• deployed and health-checked on an isolated maintainer deployment

Deployment safety

The archived predecessor repository and its production deployments were not changed. Existing runtime instances were not stopped, replaced, rebooted, or deleted. Rebuilt runtime images apply only to environments created afterward.