feat: improve create TUI model setup

[notgitika]

Improves the project create TUI model selection and spacing.

• Added provider selection for Bedrock, OpenAI, Gemini, and LiteLLM.
• Kept provider-specific model settings together on one page.
• Reused the existing API key ARN input for supported providers.
• Moved recommended runtime and memory options to the top.
• Fixed radio alignment, review-page spacing, progress-spinner spacing, and small-terminal layout.
• Added tests for model selection, navigation, validation, and layout.

Tested the TUI manually

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.63296% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.22%. Comparing base (8dc1051) to head (e2a6f99).
⚠️ Report is 13 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/handlers/project/create/screen.tsx	93.20%	17 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2164      +/-   ##
============================================
- Coverage     97.25%   97.22%   -0.04%     
============================================
  Files           508      508              
  Lines         33902    34115     +213     
============================================
+ Hits          32972    33168     +196     
- Misses          930      947      +17     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice work. I traced the credential-name plumbing end-to-end and everything hangs together:

• The wizard's per-provider configs map means switching providers no longer clobbers what the user typed for another provider, and the API key is password-masked in FormTextInput + stripped from the review summary (verified by the new tests).
• credentialFor() correctly returns undefined for bedrock and for an empty-key LiteLLM, and throws only for openai/gemini with a missing key — a state the model step's onNext won't allow the user to reach, so summaryOf's render-time call is safe.
• The credentialName → placeholder apiKeyArn: "credential:<name>" swap in src/assets/cdk/bin/cdk.ts cleanly avoids widening the pinned CDK schema, and AgentCoreStack re-parses with the resolved (deployed or deterministic same-account) ARN before it reaches AgentCoreApplication, so AgentCoreHarnessRole's apiKeyArn.split('/').pop() derives the right credential name for the IAM policy.
• Schema change in projectSchemas/harness.ts makes apiKeyArn and credentialName mutually exclusive and keeps apiKeyArn-or-credentialName required for openai/gemini — with tests covering both branches. export.ts correctly prefers the explicit credentialName over the ARN-parsed fallback and reuses an already-declared project credential.
• Tests use real temp dirs and TestCoreClient — no fs / manager mocking creeping in.

No changes requested from me.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)