fix(project): tie evaluator model ARN validation to each resource type's account format

[notgitika]

What

Follow-up to #2124 addressing @nborges-aws's review comment on the evaluator model-ID ARN validator.

isValidBedrockModelId's ARN pattern made the account segment optional for both resource types:

/^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:(\d{12})?:(inference-profile|foundation-model)\/.+$/

That fixed the original foundation-model false-negative, but also accepts two impossible shapes: an account-scoped foundation-model and an accountless inference-profile. This ties each resource type to its documented account format instead:

/^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:(?:\d{12}:(?:application-)?inference-profile|:foundation-model)\/.+$/

• foundation-model → no account: arn:aws:bedrock:us-east-1::foundation-model/…
• (application-)inference-profile → account required: arn:aws:bedrock:us-east-1:123456789012:inference-profile/…

Also accepts application-inference-profile ARNs, which the previous pattern rejected (a real valid ARN type).

Testing

Extended the existing helper test to assert the two valid ARN shapes + application-inference-profile pass, and the two wrong-account-format combinations are rejected. bun test, lint, format, and typecheck pass.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice tightening of BEDROCK_ARN_PATTERN in src/projectSchemas/evaluator.ts. I verified the regex behavior manually against the documented ARN shapes:

• arn:aws:bedrock:<region>::foundation-model/... ✅
• arn:aws:bedrock:<region>:<12-digit>:inference-profile/... ✅
• arn:aws:bedrock:<region>:<12-digit>:application-inference-profile/... ✅ (newly supported)
• Mismatched account formats (e.g. account on foundation-model, or empty account on inference-profile) are now rejected ✅
• Partitions aws-us-gov and aws-cn still match ✅

Test coverage in evaluator.test.ts exercises both the new positive case (application-inference-profile) and the two rejection cases, which is exactly what this change needs. No telemetry surface is affected, and there's no mocking involved. LGTM.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.26%. Comparing base (7bf13af) to head (77f2074).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2134   +/-   ##
=========================================
  Coverage     97.26%   97.26%           
=========================================
  Files           469      469           
  Lines         28569    28569           
=========================================
  Hits          27787    27787           
  Misses          782      782           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.