feat(hyperion): multi-tenant DynamoDB runtime + AgentCore/Hyperion extensions

[adhajar-amzn]

Summary

Adds the multi-tenant infrastructure layer for the Nova Personal Assistant Platform. Replaces filesystem-based config with DynamoDB-backed tenant resolution, enabling 10K+ users on a shared OC Gateway deployment.

• src/hyperion/ — Core runtime layer: DynamoDB client (4 tables), tenant config loader with LRU cache, channel identity resolver, session manager with composite keys (tenant_{userId}:{agentId}:{rest}), KMS-encrypted credential store with per-agent + __shared__ fallback, pairing code generation/redemption
• extensions/agentcore/ — ACP runtime plugin for Bedrock AgentCore: session management, agent turn dispatch, memory namespace isolation (tenant_{userId}:{agentId})
• extensions/hyperion/ — Gateway plugin that initializes the multi-tenant runtime at startup from HYPERION_STAGE env var
• extensions/nova/src/monitor.ts — Integrates per-tenant config loading in message handler; loads from DynamoDB in multi-tenant mode, falls back to static config + allowlist in single-tenant mode
• config/openclaw.json5 — Base gateway config for ECS deployment (bind, auth, trustedProxies, ACP backend, JSON logging)

Multi-instance agents

Each user can run multiple independent agent instances (e.g., "Work Assistant", "Personal"). Default agent_id = "main" for single-instance backwards compatibility. Composite keys (user_id + agent_id) are threaded through all data access, session keys, and memory namespaces.

Data flow

Portal message → OC Gateway → Hyperion plugin (tenant config from DDB)
                             → AgentCore extension (session + memory)
                             → Bedrock AgentCore (Firecracker VM)
                             → response streams back

Test plan

• npx tsc --noEmit passes (type-check)
• Existing tests unaffected (pnpm test)
• Manual: deploy to beta ECS, send portal message, verify tenant config loads from DynamoDB
• Manual: verify credential fallback (agent-specific → __shared__)
• Unit tests for src/hyperion/ are tracked as follow-up (TASK-25)

🤖 Generated with Claude Code