feat(cp): FleetBinding config + per-fleet credential switch (ADR #19 slice 2)

[brettchien]

Drafted by Orca (ecs-claude) — flagging authorship (shared GitHub identity across the fleet).

Second slice of ADR #19 (Per-Fleet managing identity): the declare → switch half. Builds on slice-1 (#20, runtime_context).

What:

• studio-cp — FleetBinding / FleetBindings (serde/TOML): map a cluster → its managing credential. default_bindings_path() = $OAB_FLEETS_CONFIG else ~/.config/oab-studio/fleets.toml. load_bindings() treats a missing file as empty (bindings are strictly opt-in — no behavior change unless you add the file). resolve_binding_config() builds the SdkConfig a binding selects (profile-first + optional region, layered on the standard chain).
• oab-mcp — loads bindings at startup; aws_for(cluster) resolves the bound config once (memoized) and every deploy_* tool now switches through it, falling back to the default chain when no binding governs the cluster. runtime_context gains an optional cluster and reports the binding in effect.

Why: this is the proactive fix for the deploy_list incident — a bound cluster's calls run under its declared credential instead of whatever ambient [default] the chain resolves first.

Example fleets.toml:

[[fleet]]
name = "prod"
cluster = "oab"
region = "ap-east-2"
profile = "orca-prod"
expected_principal = "arn:aws:sts::504190915686:assumed-role/openab-orca-task-role/*"

Scope / notes:

• Profile-first per the agreed slice-2 scope; assume-role and the IdentityMismatch reconcile flag (compare resolved vs expected_principal) are the next slices.
• FleetBinding is operator-side credential selection, deliberately separate from the Fleet Store (ADR: Fleet Store & Control-Plane State Ownership #18) observed/lease state — the two may fold together later.
• No changes to vendored oabctl.

Verification: relying on CI (build/test --workspace on this PR) — local full builds OOM on aws-sdk-ec2 per the ci.yml note. New unit test covers binding parse + cluster match.

Relates to #19, follows #20.

🤖 Generated with Claude Code