Add AgentCore WebRTC example with KVS managed TURN

[wirjo]

Summary

• Adds a new deployment example (aws-agentcore-webrtc-kvs) that uses Amazon Kinesis Video Streams for TURN credential provisioning instead of non-AWS TURN providers
• Eliminates external dependencies for NAT traversal by fetching temporary, auto-rotating TURN credentials via the KVS GetIceServerConfig API
• Both the agent and server dynamically call KVS at connection time — no static TURN URLs or credentials to manage

Key changes

• agent/pipecat-agent.py and server/server.py: Added get_kvs_ice_servers() that calls DescribeSignalingChannel → GetSignalingChannelEndpoint → GetIceServerConfig
• scripts/setup-iam-role.sh: Added KVSTurnCredentials IAM policy for KVS access
• Replaced ICE_SERVER_URLS/ICE_SERVER_USERNAME/ICE_SERVER_CREDENTIAL env vars with a single KVS_CHANNEL_NAME
• VPC resource tags use -kvs- suffix to avoid conflicts with the existing aws-agentcore-webrtc example

Test plan

• Deploy with ./scripts/configure.sh and ./scripts/launch.sh
• Verify KVS signaling channel is auto-created on first connection
• Confirm WebRTC connection establishes with KVS TURN relay (check chrome://webrtc-internals for relay candidate type)
• Test in both VPC and PUBLIC modes

🤖 Generated with Claude Code