Implement reversible PII de-identification round trip (T1–T7)

Build the AWS side of the HNCB demo end to end (region ap-southeast-1):

- T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret
  auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap
  resolution so a ROC ID stays TW_ROC_ID.
- T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB
  gateway endpoint); only /tokenize + /restore are public.
- T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4);
  agentcore_setup.sh + a SigV4 MCP invoke test.
- T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac
  inference profile, pinned deps.
- T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo)
  chaining tokenize -> runtime -> restore.
- T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR.

Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the
real name. Secrets stay in gitignored local.auto.tfvars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

terraform/agentcore.tf

@@ -0,0 +1,41 @@
+# ---------------------------------------------------------------------------
+# AgentCore Gateway support (task T4). Terraform's AgentCore coverage lags, so the
+# Gateway + target themselves are created by scripts/agentcore_setup.sh via
+# `aws bedrock-agentcore-control`. What IS declarative here is the IAM role the
+# Gateway assumes to invoke the RAG tool Lambda -- kept in Terraform so it is
+# tagged, auditable, and torn down with the rest of the stack.
+# ---------------------------------------------------------------------------
+
+resource "aws_iam_role" "agentcore_gateway" {
+  name = "${local.name}-gateway-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "bedrock-agentcore.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+      Condition = {
+        StringEquals = { "aws:SourceAccount" = data.aws_caller_identity.current.account_id }
+      }
+    }]
+  })
+  tags = local.cloud_tag # the Gateway is a cloud-zone component
+}
+
+resource "aws_iam_role_policy" "agentcore_gateway" {
+  name = "${local.name}-gateway-policy"
+  role = aws_iam_role.agentcore_gateway.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      # The Gateway only needs to invoke the one RAG tool Lambda.
+      Effect   = "Allow"
+      Action   = ["lambda:InvokeFunction"]
+      Resource = [aws_lambda_function.rag.arn]
+    }]
+  })
+}
+
+data "aws_caller_identity" "current" {}
+
+output "gateway_role_arn" { value = aws_iam_role.agentcore_gateway.arn }