feat(payments): attribute SDK usage via user-agent surface tag and created-by resource tag

[rajuans]

What

Two complementary origin signals for AgentCore Payments so we can measure who is calling and what the SDK created.

1. Per-call surface tag (User-Agent, carrier A1)

• build_user_agent_suffix gains an optional feature token → bedrock-agentcore/X.Y.Z (integration_source=strands; feature=payments).
• PaymentManager (data plane) and PaymentClient (control plane) now take integration_source (default raw-sdk) and emit it with feature=payments.
• Strands plugin sets integration_source="strands"; LangGraph middleware sets "langgraph".
• Lets the payments DP count callers by surface / version / operation from each request. No new data leaves the caller.

2. Durable created-by resource tag

• create_payment_manager stamps agentcore:created-by=agentcore-sdk, default-if-absent (a caller-supplied value and other tags are preserved).
• Covers the composite create_payment_manager_with_connector path automatically.
• Scope is payment manager only — CreatePaymentConnector has no tags in its API model, and credential providers are created via a separate IdentityClient.

Tests

• New tests/bedrock_agentcore/_utils/test_user_agent.py — user-agent formatting, feature token, sanitization.
• New test_client.py cases — created-by tag injection and caller-override preservation.
• Updated Strands/LangGraph init assertions for the new integration_source kwarg.
• Full payments suite green (653 passed, 9 testnet-only skipped); ruff lint + format clean.

⚠️ Pre-merge check

The agentcore: tag-key prefix passes the botocore model pattern, but I have not verified the control plane accepts caller-supplied agentcore:-prefixed keys at runtime (services sometimes reserve such prefixes). Please validate create_payment_manager against a personal/alpha stack before merging; if rejected, fall back to agentcore-created-by.

[github-actions]

⚠️ Breaking Change Warning

Found 3 potential breaking change(s) in this PR:

�[1msrc/bedrock_agentcore/payments/client.py�[0m:255: PaymentClient.init(�[34mintegration_source�[39m): �[33mParameter default was changed�[39m: None -> 'raw-sdk'
�[1msrc/bedrock_agentcore/payments/client.py�[0m:269: PaymentClient.integration_source: �[33mAttribute value was changed�[39m: integration_source -> integration_source or 'raw-sdk'
�[1msrc/bedrock_agentcore/payments/integrations/langgraph/middleware.py�[0m:96: AgentCorePaymentsMiddleware.payment_manager: �[33mAttribute value was changed�[39m: PaymentManager(payment_manager_arn=config.payment_manager_arn, region_name=config.region, agent_name=config.agent_name, bearer_token=config.bearer_token, token_provider=config.token_provider) -> PaymentManager(payment_manager_arn=config.payment_manager_arn, region_name=config.region, agent_name=config.agent_name, bearer_token=config.bearer_token, token_provider=config.token_provider, integration_source='langgraph')

---

Note: This is an automated static analysis check. Some flagged changes may be intentional.
Please confirm each item is expected and, if so, add a migration note to CHANGELOG.md.

[rajuans]

Superseded by aws#669 (raised against upstream).