Component cost-allocation tag on every stack

[Robobc]

What

Roadmap R3 phase 1: every stack gets a Component tag (its suffix in the deployment contract — gateway, memory, runtime-orchestrator, use-case stacks included), so Cost Explorer can split spend per component once the tag is activated. One loop in app.py before synth — no per-stack edits, future stacks tagged for free.

Changes

• app.py — Component tag loop next to the existing global tags (Project/Environment/ManagedBy).
• README — new 'Track Costs per Component' section: one-time activation command, ~24h propagation, and honest scope (resource costs only; AgentCore Memory/SSM take no CFN tags; Bedrock inference needs Application Inference Profiles — tracked separately).
• tests/test_cost_tags.py — source pin so the loop can't silently disappear (nothing else fails when tagging breaks).

Verified

• ruff clean; pytest 194 passed; check-contract.sh all 6 presets PASS.
• Synth: orchestrator template carries Component: runtime-orchestrator on taggable resources; memory template has no tags at all — confirmed pre-existing (it never carried the global Project tag either; AWS::BedrockAgentCore::Memory and SSM parameters accept no CFN tags).

Review notes

• Phase 2 (Application Inference Profiles for Bedrock CUR attribution) is deliberately split out: context-gathering found three real hazards (the IAM wildcard doesn't cover application-inference-profile/*, ChatBedrock rejects ARN model ids without an explicit provider, and the allow-list validator rejects ARNs). I'll open a scoped Asana task for it.
• The task note sketched Agent/Team/UseCase tags; shipped as one Component dimension instead — Team has no source in platform.yaml today, and Component uses the contract's existing vocabulary. Say the word if you want a Team tag key added to platform.yaml.

[github-actions]

Commit: cf835ad | Updated: 2026-09-04 08:37:22 UTC

Security Scan Results

Scanner	S	C	H	M	L	I	Time	Action	Result	Thresh
bandit	0	0	0	0	3	0	466ms	0	PASSED	MED (g)
cdk-nag	0	0	0	0	0	0	8.4s	0	PASSED	MED (g)
cfn-nag	0	0	0	0	0	0	6ms	0	PASSED	MED (g)
checkov	0	0	0	0	0	0	4.7s	0	PASSED	MED (g)
detect-secrets	0	0	0	0	0	0	429ms	0	PASSED	MED (g)
grype	0	0	0	0	0	0	1m 2s	0	PASSED	MED (g)
npm-audit	0	0	0	0	0	0	506ms	0	PASSED	MED (g)
opengrep	0	0	0	0	0	0	19.1s	0	PASSED	MED (g)
semgrep	0	0	0	0	0	0	<1ms	0	MISSING	MED (g)
syft	0	0	0	0	0	0	2.6s	0	PASSED	MED (g)