fix(e2e): broaden CUSTOM_JWT rejection regex to match service response

[notgitika]

What

Fixes the harness-custom-jwt.test.ts e2e test that has been failing on mainline since the harness flows were brought into the standard build (PR #1598).

Root Cause

The test deploys a harness with a CUSTOM_JWT authorizer (Cognito), then invokes without an explicit --bearer-token. The CLI auto-attaches a bearer token via the managed OAuth credential. The Cognito access_token lacks a standard aud claim (Cognito uses client_id instead), so the service's HarnessAuthValidator.validateTokenAudience() in YggdrasillDataPlaneService rejects it with:

AgentCore API error (403): {"message":"*** missing required audience claim."}

The test's regex only matched configured for CUSTOM_JWT, authoriz(ation|er).*mismatch, or different.*authorization — none of which match the actual service response.

Fix

Broaden the regex to also accept missing required audience claim. The test's intent (SigV4/invalid-auth is rejected with 403) is unchanged — the exitCode !== 0 assertion still validates the rejection. The negative assertion on line 262 (not.toMatch) remains safe because a successful bearer-token invoke will never contain this message.

Testing

• Verified the regex matches the actual error from the CI logs
• The negative assertion (expect(output).not.toMatch(...)) on the bearer-token success path is unaffected since a successful invoke returns the agent response, not an auth error

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.20.2.tgz

How to install

gh release download pr-1622-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.20.2.tgz

[agentcore-cli-automation]

LGTM. Targeted one-line regex fix to an e2e test; the root-cause analysis in the PR description matches what I see in the code:

• The harness test exercises the managed-OAuth path (--client-id/--client-secret on add harness), which causes the CLI to auto-attach a bearer token on the "SigV4-only" invoke. That request reaches the service, which rejects on the audience claim — the existing regex didn't cover that response.
• The sibling byo-custom-jwt.test.ts patches agentcore.json directly without registering a managed credential, so no token is auto-attached and the rejection happens via a different path that the existing regex already matches. No update needed there.
• The negative assertion on line 263 (not.toMatch) remains safe — a successful invoke response won't contain "missing required audience claim".

No source/telemetry impact, e2e-test-only change.

[notgitika]

this one makes more sense #1624