fix(bma): rename environment template and skip unsupported dev

[Hweinstock]

Problem

• The public BMA template is named bedrock-managed-agents which doesn't match the existing pattern.
• The current dev experience does not mirror that of other templates, and is not meaningful to customers yet.
• the starting lockfile also has five Fastify audit findings.

Solution

• Rename the public BMA template to environment-python-bma across scaffolding, TUI choices, and help.
• Skip BMA in mixed dev sessions; reject individual selection with NotImplementedError and source: "user".
• Update Fastify to 5.12.5 in the lockfile to resolve the five audit findings.

Verification

Verified with the compiled Linux CLI:

Scenario	Result
Create wizard and create/add help	Show environment-python-bma; the wizard screenshot is retained locally.
Headless create	Scaffolds the BMA lifecycle server, container settings, policy, and runtime tag.
BMA-only or explicit BMA dev	Both headless and browser modes exit 1 before runners or collectors start.
Mixed dev and Inspector reload	Skip BMA and retain supported runtimes; a real HTTP invocation succeeds.
Overridden or missing BMA tags	The policy still identifies BMA and prevents local dev.

> agentcore create --name BmaExample --template environment-python-bma --skip-install --skip-git --json --region us-west-2
{"operation":"create","project":{"name":"BmaExample",...}}

> agentcore dev --mode headless --agent agent --region us-west-2
Local dev is not supported for runtime 'agent' (environment-python-bma). Run agentcore deploy, then use client.py to connect through Bedrock Managed Agents.

> agentcore dev --mode headless --no-traces --port 16883 --region us-west-2
Skipping runtime 'agent': local dev is not supported for environment-python-bma.
[local] Agent 'local' is running on port 16883.
> curl -sS http://127.0.0.1:16883/invocations -H 'Content-Type: application/json' -d '{"prompt":"hello"}'
{"agent": "local", "ok": true}

demo-bma.mov

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

The rename from bedrock-managed-agents → environment-python-bma is applied consistently across schemas, shortcuts, resolvers, scaffolding, screens, help, and tests. The classification helper isBmaRuntime correctly covers both the tag and the policy fallback, so legacy specs are still recognized. The dev-handler logic is sound:

• selectRuntimes throws ResourceNotFoundError when a user-named runtime doesn't exist, and NotImplementedError (with source: USER, exit 1) when the only matches are BMA.
• Mixed sessions log a skip for each BMA runtime and continue with the supported ones; reload paths filter the same way.
• The NotImplementedError constructor change (letting callers override source via a spread) is backward-compatible — existing callers still default to INTERNAL.

A couple of small things I noticed but which don't warrant changes:

• The "Skipping runtime 'X'" status is emitted for every BMA runtime in the project even when the user passed --agent for a specific supported runtime; slightly noisy but harmless.
• The NotImplementedError message hard-codes environment-python-bma, even though a runtime can be classified as BMA purely via the policy file (not the tag). In the rare "configured BMA by hand" case the message names a template the user didn't use. Not worth fixing.

No blocking issues. Nothing new to flag beyond the prior discussion.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.40%. Comparing base (b28dd21) to head (8e12d14).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2501   +/-   ##
=========================================
  Coverage     97.39%   97.40%           
=========================================
  Files           642      642           
  Lines         46839    46862   +23     
=========================================
+ Hits          45620    45644   +24     
+ Misses         1219     1218    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

The "Skipping runtime 'X'" status is emitted for every BMA runtime in the project even when the user passed --agent for a specific supported runtime; slightly noisy but harmless.

fair callout. Updating now to avoid the noise.

The NotImplementedError message hard-codes environment-python-bma, even though a runtime can be classified as BMA purely via the policy file (not the tag). In the rare "configured BMA by hand" case the message names a template the user didn't use. Not worth fixing.

I don't think customers could / would hand roll this template, so I think we are okay here.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[aidandaly24]

This looks good to me

[aidandaly24]

Nice this is simple

[aidandaly24]

Nice and this function gives us flexibility in the future if theres more runtimes like this