feat(core): add enableTransactionSearch helper

[jariy17]

Why

The old CLI enabled CloudWatch Transaction Search on every deploy; the refactor CLI dropped it. Without it, agent OTel spans never reach aws/spans, and evaluations (batch, A/B, insights, online) have nothing to score. This adds the helper back; a follow-up PR wires it into deploy.

What (PR 1 of 2)

src/core/transactionSearch.ts — enableTransactionSearch(clients, { region, accountId, indexPercentage=100 }), four idempotent steps:

1. Application Signals StartDiscovery (service-linked role)
2. CloudWatch Logs resource policy letting X-Ray write aws/spans + /aws/application-signals/data (skipped if present)
3. X-Ray UpdateTraceSegmentDestination → CloudWatchLogs (skipped if already set)
4. X-Ray UpdateIndexingRule Default → indexPercentage

Hard-fails with a new TransactionSearchSetupError (USER source, names the failed step) if any step errors. Clients are injectable; transactionSearchClients() builds the real ones. GovCloud/China partitions handled.

Adds deps @aws-sdk/client-xray, @aws-sdk/client-application-signals. No deploy behavior change yet (helper is unused until PR 2).

Tests

6 unit tests: full ordered setup, both idempotent skips, custom index %, hard-fail naming the denied step, GovCloud partition.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Nice, self-contained module. The tests use a minimal fake send at the SDK boundary rather than mocking internals, which lines up with the mocking guidance, and the API shapes (resourcePolicies / policyName lowercase for CWL, Destination, Rule.Probabilistic.DesiredSamplingPercentage PascalCase for X-Ray, empty StartDiscovery input for Application Signals) all match the current SDKs.

A few small things worth being aware of, but none block merge:

• enableTransactionSearch isn't wired into the deploy path in this PR. Assuming that's a follow-up — just calling it out so it doesn't get forgotten, since the module comment promises it runs on every deploy. Telemetry instrumentation for setup success/failure would be nice to add when that wiring lands.
• Step 2 skips PutResourcePolicy whenever a policy named TransactionSearchXRayAccess exists, without checking its contents. That's fine for idempotency, but if the shape of the policy ever changes (e.g. adding a new log group or partition ARN), existing accounts won't be reconciled. Worth noting in a comment or handling with an explicit version bump when that happens.
• DescribeResourcePolicies is paginated. In practice CWL caps resource policies at 10 per region so this is a non-issue today, but if that ever changes an unpaginated scan could miss the existing policy and overwrite a customer-modified one.
• Only the StartDiscoveryCommand failure path is exercised in tests. Adding a case that fails on one of the later steps would give more confidence the same wrapping applies to every step (cheap to add given the harness).

None of these require changes before merging.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 87.05882% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.24%. Comparing base (a23e472) to head (33c9fcb).

Files with missing lines	Patch %	Lines
src/core/transactionSearch.ts	86.41%	11 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2355      +/-   ##
============================================
- Coverage     97.26%   97.24%   -0.03%     
============================================
  Files           610      611       +1     
  Lines         40590    40675      +85     
============================================
+ Hits          39480    39554      +74     
- Misses         1110     1121      +11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jariy17]

Combined into #2356, which now carries both the helper and the deploy wiring against refactor.