feat(studio): reuse IAM roles for new agent runtimes

[evanlowe]

Studio previously created a default IAM role for new Agents and added AgentKitFullAccess for quick creation. Ordinary and quick creation now reuse the first role with the AgentKitDefaultRuntimeAccess system policy, scanning all IAM role pages as needed. If no role matches, Studio keeps the existing AgentKit_Runtime_Default_ServiceRole_<7 random characters> naming rule and attaches only that policy

Existing roles retain their permissions. IAM lookup failures stop deployment instead of creating a fallback role, and failed lookups finish the progress stream so the same task can be retried. The behavior applies to Volcengine and BytePlus. Existing Runtime updates and Sidecar deployments retain their role-selection behavior

Validation

• Rebased onto the latest origin/main
• Pre-commit checks, formatting and secret scanning passed
• Focused type checks passed with no errors
• CI passed on the latest commit: full Python 3.10/3.12 unit suites, license headers, pre-commit, secret scanning, frontend checks and Studio release validation
• Local Runtime IAM and Studio RBAC invocation: 155 passed; 2 media-access logging assertions failed and were reproduced unchanged on main at bb580013 in the same local environment
• Live deployment from local Studio: a Volcengine ordinary Agent used a newly created role, and a BytePlus quick Agent reused a role that existed before the test; both Runtimes reached Ready, and Runtime/IAM APIs confirmed their bindings and the single AgentKitDefaultRuntimeAccess policy
• Console inspection confirmed the new Volcengine role has exactly one policy. Console-page verification of the Runtime bindings and the BytePlus role remains incomplete