feat(cdk): grant Claude Opus 5 (additive IAM + workflow allowlist, no default change)

[scottschreckengaust]

Child 3 of 6 — parent #741. Deploys safely. Purely additive; zero behavior change.

Grants the capability to invoke Opus 5 without anything selecting it. Must be deployed before child 4 flips the default, or the agent gets AccessDenied at turn 0.

Verified prerequisites (us-east-1, acct 677276119483)

aws bedrock list-inference-profiles / list-foundation-models:

ID	Kind	Status	InvokeModel
anthropic.claude-opus-5	foundation model	present	❌ ValidationException — on-demand not supported for bare IDs
us.anthropic.claude-opus-5	SYSTEM_DEFINED profile	ACTIVE	✅ 200
global.anthropic.claude-opus-5	SYSTEM_DEFINED profile	ACTIVE	✅ 200

Account model access is already entitled — both profiles return 200, so this is not blocked on Bedrock model-access prerequisites.

Profile ARN shape is identical between geos and needs no special handling:

arn:aws:bedrock:us-east-1:<acct>:inference-profile/us.anthropic.claude-opus-5
arn:aws:bedrock:us-east-1:<acct>:inference-profile/global.anthropic.claude-opus-5

Regional + account-qualified, matching what CDK's Arn.format already emits with Aws.REGION/Aws.ACCOUNT_ID.

Scope

1. cdk/src/constructs/bedrock-models.ts:34 — add anthropic.claude-opus-5 to DEFAULT_BEDROCK_MODEL_IDS. Bare ID, no geo prefix — resolveBedrockModelIds rejects prefixed entries at synth (line 84) and both grant sites derive the profile ARN themselves.

Keep anthropic.claude-opus-4-8 in the list. Blueprints may pin it per-repo; removing it would break those repos at turn 0. Retiring 4.8 is a separate, announced change.

2. cdk/src/handlers/shared/workflows.ts:84 — add both forms to WORKFLOW_MODEL_ALLOWLIST (anthropic.claude-opus-5 and us.anthropic.claude-opus-5), matching the existing pattern where each model appears bare and us.-prefixed. Without this, a workflow pinning Opus 5 fails admission. Hold global. back until child 6 — grant only what's reachable in this step.

3. Tests — mirror the existing assertions:

• cdk/test/stacks/agent.test.ts:265-266 style: foundation-model/anthropic.claude-opus-5 and inference-profile/us.anthropic.claude-opus-5 both present
• cdk/test/constructs/ecs-agent-cluster.test.ts:415-418 style: same for the ECS task role
• Assert 4.8 is still granted (regression guard for the keep-4.8 decision)

Why this is safe to deploy alone

Adds two ARNs to an IAM policy and two strings to an admission allowlist. No default changes, no env var changes, nothing selects Opus 5 yet. The bedrockModels context override still works unchanged. Worst case is a slightly wider grant than currently exercised — which is the point.

Acceptance criteria

• anthropic.claude-opus-5 in DEFAULT_BEDROCK_MODEL_IDS; anthropic.claude-opus-4-8 retained
• Both bare and us. forms in WORKFLOW_MODEL_ALLOWLIST
• Grant assertions added for both AgentCore runtime and ECS task role
• Regression assertion: 4.8 still granted
• cdk/test/constructs/bedrock-models.test.ts:83 drift guard still passes untouched (default is still us.-prefixed 4.8 at this point — the guard's /^us\./ assertion is not yet in play)
• mise //cdk:eslint + mise run build green
• cdk diff reviewed: IAM policy additions only, no other resource deltas

Notes

Blocks #745 (default flip). Independent of #742/#743.

[scottschreckengaust]

@scottschreckengaust (agent:w3) working on it — #744 — branch feat/744-grant-opus-5