[refactor] Generated Runtime role lacks AgentCore Browser permissions

[Hweinstock]

Problem

On CLI refactor commit
53f13f6431169ea247088c948551c7b0b824feef, deploying an agent that uses
AgentCore Browser creates a Runtime execution role without
bedrock-agentcore:StartBrowserSession.

The deployment can succeed, but the first browser-tool invocation fails with
an AccessDeniedException for StartBrowserSession.

Repro

1. Deploy a container Runtime whose agent uses the AgentCore Browser toolkit.
2. Invoke the deployed agent with a browser task.
3. Observe the generated role's authorization failure:

is not authorized to perform: bedrock-agentcore:StartBrowserSession

The refactor Runtime add path does not expose or preserve the Runtime
connections[] declaration:

• runtime handler
• runtime input schema
• runtime spec builder

The --connections omission is therefore the configuration symptom; the
user-visible bug is the missing browser permission.

Fix

Ensure browser usage results in the generated Runtime role receiving the
Browser session permissions, including StartBrowserSession, and add an
end-to-end regression test covering deploy plus browser invocation.