Add support for the PolicyEngine resource (#33)

Issue #, if available:

Description of changes:
 Adds a new PolicyEngine custom resource to the bedrock-agentcore-control controller, enabling
  AgentCore policy engines to be managed declaratively via Kubernetes.

  - Enabled the resource in generator.yaml (removed PolicyEngine from the ignore list) and
  configured its full CRUD mapping:
    - PolicyEngineId renamed to ID (primary key) across the Create/Get/Update/Delete
  operations.
    - Name marked immutable; EncryptionKeyArn immutable with a cross-resource reference to KMS
  Key.
    - Read-only status fields sourced from GetPolicyEngine: CreatedAt, UpdatedAt,
  StatusReasons.
    - synced / updateable / deletable conditions keyed off Status.Status (ACTIVE, plus the
  *_FAILED terminal states).
    - ValidationException treated as terminal; 404 mapped to ResourceNotFoundException.
  - Custom hooks (hooks/policy_engine/):
    - sdk_update_post_build_request — wraps Description updates in the API's UpdatedDescription
  optional-value shape.
    - sdk_update_pre_build_request — syncs tags and short-circuits when only tags differ.
    - sdk_read_one_post_set_output — fetches tags on read
  APIs are unavailable (logs and continues rather than failing reconcile).
  - Generated artifacts: new API types (policy_engine.go), CRD manifest, resource
  manager/SDK/references/identifiers/delta, RBAC and Helm role entries, and controller
  registration in cmd/controller/main.go.
  - E2E tests (test/e2e/tests/test_policy_engine.py): create/delete, update description, and
  update tags.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Author: knottnt

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,13 +1,13 @@
 ack_generate_info:
-  build_date: "2026-06-22T22:57:25Z"
+  build_date: "2026-06-24T23:08:34Z"
   build_hash: 2ae5d2cfadaa2a10b2ccb9e73a111b2a91c36642
-  go_version: go1.26.4
+  go_version: go1.26.2
   version: v0.60.0
-api_directory_checksum: 690c23f673c0c713394e7370ed49ca7ae518422d
+api_directory_checksum: abe5cc81ff91c1051ef312264c44cf7a52573587
 api_version: v1alpha1
 aws_sdk_go_version: v1.41.5
 generator_config_info:
-  file_checksum: c0e74d88a5f60e8b47268a9ff81d835bdd37ed2d
+  file_checksum: a56edc199bac647a07a6a5f25cfc3b01e123e5c5
   original_file_name: generator.yaml
 last_modification:
   reason: API generation

apis/v1alpha1/enums.go

@@ -13,7 +13,7 @@ ignore:
     - Oauth2CredentialProvider
     - OnlineEvaluationConfig
     - Policy
-    - PolicyEngine
+    # - PolicyEngine
     # - WorkloadIdentity
 
   field_paths:
@@ -178,6 +178,87 @@ resources:
       sdk_update_post_build_request:
         template_path: hooks/memory/sdk_update_post_build_request.go.tpl
 
+  PolicyEngine:
+    ignore_idempotency_token: true
+    renames:
+      operations:
+        CreatePolicyEngine:
+          output_fields:
+            PolicyEngineId: ID
+        GetPolicyEngine:
+          input_fields:
+            PolicyEngineId: ID
+        UpdatePolicyEngine:
+          input_fields:
+            PolicyEngineId: ID
+        DeletePolicyEngine:
+          input_fields:
+            PolicyEngineId: ID
+    fields:
+      ID:
+        is_primary_key: true
+      Name:
+        is_immutable: true
+      EncryptionKeyArn:
+        is_immutable: true
+        references:
+          resource: Key
+          service_name: kms
+          path: Status.ACKResourceMetadata.ARN
+      Description:
+        set:
+          - method: Update
+            ignore: "to"
+      CreatedAt:
+        is_read_only: true
+        from:
+          operation: GetPolicyEngine
+          path: CreatedAt
+      UpdatedAt:
+        is_read_only: true
+        from:
+          operation: GetPolicyEngine
+          path: UpdatedAt
+      StatusReasons:
+        is_read_only: true
+        from:
+          operation: GetPolicyEngine
+          path: StatusReasons
+    synced:
+      when:
+        - path: Status.Status
+          in:
+            - ACTIVE
+            - CREATE_FAILED
+            - UPDATE_FAILED
+            - DELETE_FAILED
+    updateable:
+      when:
+        - path: Status.Status
+          in:
+            - ACTIVE
+    deletable:
+      when:
+        - path: Status.Status
+          in:
+            - ACTIVE
+            - CREATE_FAILED
+            - UPDATE_FAILED
+            - DELETE_FAILED
+    exceptions:
+      errors:
+        404:
+          code: ResourceNotFoundException
+      terminal_codes:
+        - ValidationException
+    hooks:
+      sdk_read_one_post_set_output:
+        template_path: hooks/policy_engine/sdk_read_one_post_set_output.go.tpl
+      sdk_update_pre_build_request:
+        template_path: hooks/policy_engine/sdk_update_pre_build_request.go.tpl
+      sdk_update_post_build_request:
+        template_path: hooks/policy_engine/sdk_update_post_build_request.go.tpl
+
   WorkloadIdentity:
     fields:
       Name: