refactor(provider-webdriver): ship AWS Device Farm as the @agent-device/aws-device-farm plugin #3310

Purpose and evidence

0.22 stops bundling hosted device providers with the default installation. AWS Device Farm already presents the plugin factory shape inside core (packages/provider-webdriver/src/aws-device-farm-provider.ts plus aws-device-farm-connection.ts, PR #3312). The one capability it needs that ProviderPluginHost does not expose is a host-command runner: the provider drives aws devicefarm ... through runHostCommand, which core currently supplies in src/provider-webdriver.ts.

Required behavior and boundary

• Extend the experimental plugin SDK: ProviderPluginHost gains runHostCommand(command, args): Promise<{ stdout }> backed by runCmd with the bounds core uses today (10 MiB buffer, 30 s). Keep the SDK declaration small; the packed declaration-size guard from feat: add managed provider plugin infrastructure #3121 stays green.
• New workspace package packages/provider-aws-device-farm publishing @agent-device/aws-device-farm, built and released like TestMu. The default export returns { webDriver, connection }; the manifest declares provider: "aws-device-farm" and the connection capabilities from CLOUD_WEBDRIVER_PROVIDER_DECLARATIONS (no credentialVariables: the AWS CLI credential chain has no environment fingerprint, and the fingerprint tests pin that).
• Move aws-device-farm.ts, aws-device-farm-artifacts.ts, aws-device-farm-provider.ts, aws-device-farm-connection.ts, aws-device-farm-connection-verification.ts and their tests out of provider-webdriver. The requires --aws-project-arn <arn> or AWS_DEVICE_FARM_PROJECT_ARN messages and the flag-then-AGENT_DEVICE_*-then-AWS_* selector order stay as they are.
• Core drops aws-device-farm from BUNDLED_CLOUD_WEBDRIVER_PROVIDERS and RESERVED_PLUGIN_PROVIDERS; connectionProviderCapabilities and the requiresAppAttachment reconnect hint in connection-presentation.ts keep working from the manifest.
• Help, website/docs/docs/aws-device-farm.md, device-clouds.md, plugins.md, and the README move the provider to the plugin install flow.

agent-device plugins add @agent-device/aws-device-farm
agent-device connect aws-device-farm --platform android --aws-project-arn <arn> --aws-device-arn <arn> --aws-app-arn <arn>

Completion and validation

• node scripts/check-provider-plugin.mjs packages/provider-aws-device-farm passes with a fixture aws on PATH.
• The AWS provider-scenario tests (cloud-webdriver-provider-adapters, cloud-webdriver-provider-regressions, stale-provider-runtime-admission) build the runtime from the plugin factory with the fake host command.
• pnpm check:affected --run passes; Size report shows the default install shrinking.
• One live Device Farm remote-access session with the packed plugin, recorded in the PR, or the exact blocker named.

Dependencies and readiness

Blocked by: #3312 landing on main; do the BrowserStack extraction first so the packaging template is proven twice before the SDK change here.

Effort: M. Risk: medium (SDK surface grows by one method; AWS live verification needs an account).