fix(payments): keep generated payment credential names ARN-safe

[dfernaro]

Description

agentcore add payment-connector builds the connector's credential name as <manager>-<connector>-<suffix>. Connector names may contain underscores, so --name my_cdp produced the credential PayMgr-my_cdp-cdp. CreatePaymentCredentialProvider accepts underscores in the name, but PaymentCredentialProviderConfiguration.credentialProviderArn only allows [a-zA-Z0-9-.]+ after paymentcredentialprovider/, so the connector can't reference the provider. agentcore validate didn't catch it. This is the main variant of #2533.

• add payment-connector now replaces underscores with hyphens in the generated credential name (my_cdp → PayMgr-my-cdp-cdp). The connector keeps its own name. The .env.local variable names don't change, because computePaymentCredentialEnvVarNames already maps - to _, so both names use AGENTCORE_CREDENTIAL_PAYMGR_MY_CDP_CDP_*.
• agentcore validate now fails when a payment connector's credentialName doesn't fit the ARN pattern, and names the credential to rename it to. This covers projects that already have an underscored credential name.
• docs/payments.md lists the new validate check.

Related Issue

Part of #2533. That issue targets the refactor branch, so this PR fixes the same problem on main without closing it.

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

New unit tests cover the generated credential name (and its unchanged env var names), the validate failure with the rename hint, and the name check. The first two fail against the current code.

I also ran the built CLI locally, comparing main and this branch:

Scenario	main	This branch
add payment-connector --name my_cdp	credential PayMgr-my_cdp-cdp, validate passes	credential PayMgr-my-cdp-cdp, validate passes
Project created with main (underscored credential)	validate passes	validate fails and names PayMgr-my-cdp-cdp
Same project after renaming as the message says, .env.local untouched	—	validate passes
remove payment-connector	—	removes the credential and its .env.local variables

I didn't deploy a real CoinbaseCDP connector; the ARN constraint comes from the API reference linked above.

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots (no asset changes)

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.