terraform

Add kms:Decrypt to pod IAM policy for KMS-encrypted secrets

Fix SecretProviderClass: add jmesPath to extract username/password from JSON

Add containers recipe with CSI Secrets Store and IRSA support

Auto-create OIDC provider for IRSA in agent recipe

Use updated agent-runtime image with AWS/Bedrock support