feat: add VPC network mode to TUI wizard

[tejaskash]

Summary

• Adds VPC network mode selection to the TUI wizard for both Create (template) and BYO (bring your own code) agent flows
• When VPC is selected, prompts for comma-separated subnet IDs and security group IDs with input validation
• Selecting PUBLIC skips subnet/security group steps
• Adds VPC warning banners to dev and invoke TUI screens when the selected agent uses VPC network mode
• Adds shared vpc-validation.ts with subnet/security group ID validation utilities

New TUI wizard steps

1. Network Mode — select PUBLIC or VPC (inserted after model provider / API key steps)
2. Subnets — comma-separated subnet IDs (only shown for VPC)
3. Security Groups — comma-separated security group IDs (only shown for VPC)

VPC warnings

• Dev screen: "This agent uses VPC network mode. Local dev server runs outside your VPC. Network behavior may differ from deployed environment."
• Invoke screen: "This agent uses VPC network mode. Network behavior may differ if VPC endpoints are not configured."

Test plan

• npm run build compiles
• npm test passes
• agentcore create — walk through wizard, verify VPC steps appear when VPC selected, PUBLIC skips them
• agentcore add agent --type byo — verify VPC steps in BYO path
• Confirm view shows Network Mode, Subnets, Security Groups for VPC agents
• agentcore dev with VPC agent — verify warning banner
• agentcore invoke with VPC agent — verify warning banner

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.76%	2988 / 6827
🔵	Statements	43.37%	3147 / 7256
🔵	Functions	45.44%	619 / 1362
🔵	Branches	48.48%	1957 / 4036

Generated in workflow #711 for commit 678de14 by the Vitest Coverage Report Action