fix: add batch eval and recommendation IAM permissions to docs

[notgitika]

Summary

Adds missing IAM permissions to docs policy files for batch evaluation and recommendations:

• Add BatchEvalAndRecommendations statement to iam-policy-user.json (9 actions)
• Add CloudWatch Logs write permissions to LogsStreamingAndSearch (DescribeLogGroups, CreateLogGroup, CreateLogStream, PutLogEvents, PutRetentionPolicy)
• Update PERMISSIONS.md with batch eval/recommendations reference section and logging entries

Also applied logs:PutRetentionPolicy to the e2e-github-actions role in the test account.

Context

E2E batch eval tests were failing with 403 on PutRetentionPolicy -- the batch eval API sets a retention policy on its results log group.

Test plan

• iam-policy-user.json is valid JSON
• prettier passes
• Applied PutRetentionPolicy to e2e-github-actions role
• Re-run E2E to confirm batch eval tests pass

[agentcore-cli-automation]

Thanks for adding these permissions. One issue worth addressing before merge:

The CLI Commands column in PERMISSIONS.md references commands that don't exist in the CLI today.

In the new "Batch evaluation and recommendations" table:

• run batch-eval — no such command. run only has the eval subcommand (see src/cli/commands/run/command.tsx).
• run recommend — no such command.
• evals history is listed for bedrock-agentcore:ListBatchEvaluations, but evals history is a local-only command that reads from disk via handleListEvalRuns → listEvalRuns() (see src/cli/operations/eval/list-eval-runs.ts and src/cli/commands/eval/command.tsx). It makes no AWS API call, so it doesn't require ListBatchEvaluations.

I also couldn't find any references to StartBatchEvaluation, StartRecommendation, etc. anywhere in src/ or the e2e tests — the run eval code path uses the Evaluate API (already covered).

If the service is invoking batch eval / recommendation APIs server-side on behalf of the user when run eval is called (which would explain the PutRetentionPolicy 403 you mentioned in the description), it might be worth:

Options to address this:

1. Update the CLI Commands column entries to point to the actual command that triggers these permissions (e.g. run evals if that's the command that indirectly causes batch eval invocations server-side), and update the Purpose column to explain it's service-invoked on behalf of the caller.
2. Drop the Batch evaluation and recommendations section from PERMISSIONS.md and the BatchEvalAndRecommendations statement from iam-policy-user.json for now if no CLI command actually calls these APIs — and only keep the logs permissions that are actually failing (PutRetentionPolicy, etc.).
3. If these commands are planned/upcoming, either add them in this PR or gate the doc changes until the commands land, so the docs don't advertise commands users can't run.

The logs:* additions (PutRetentionPolicy, CreateLogGroup, CreateLogStream, PutLogEvents, DescribeLogGroups) look fine as long as the batch-eval-via-service-principal explanation holds, though the CLI Commands column still lists the non-existent run batch-eval for most of them and should be fixed the same way.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.04%	8990 / 20883
🔵	Statements	42.33%	9546 / 22550
🔵	Functions	39.91%	1552 / 3888
🔵	Branches	39.92%	5794 / 14511

Generated in workflow #2378 for commit 1b9ef28 by the Vitest Coverage Report Action