Runs a de-id round trip then searches the live AgentCore/Bedrock trace to show
the token appears and the real name has 0 hits — proof the cloud only ever saw a
token. `--last` proves against recent trace without a new round trip (snappy for
running right after the UI demo). Discovers the runtime log group automatically.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
