fix: Kinesis event-source region, EventBridge archive rule ARN, Logs group ARN form, cached Bedrock regexes

[vieiralucas]

Summary

Four independent correctness follow-ups found during the ARN partition campaign, one commit each:

• fix(lambda): report the Kinesis stream's region in event-source records. The Kinesis -> Lambda poller hardcoded "awsRegion": "us-east-1"; records now carry the stream's region from its ARN.
• fix(eventbridge): put the custom bus in an archive's managed rule ARN. CreateArchive built the managed rule ARN in the default-bus form even for a custom-bus archive; it now uses rule_arn with the source bus (rule/<bus>/Events-Archive-<name>), matching AWS.
• fix(logs): store one log group ARN form across every creation path. CreateLogGroup stored ...:log-group:<name>:* while groups created by ingest and EventBridge delivery stored it without :*. Every path now stores the :* form; arn (with :*) and logGroupArn (without) render from it per the model. Also fixes stream ARNs like log-group:g:*:log-stream:s for CreateLogGroup-made groups, and suffixed logGroupIdentifier/syslog ARNs. Older snapshots (either form) still resolve.
• perf(bedrock-agent-runtime): compile identifier regexes once. The helpers recompiled their regexes on every request despite the "Cached regexes" comment; they're LazyLock<Regex> now. Patterns byte-identical (they mirror the Smithy model's ECMA semantics).

No surface changes.

Test plan

• New tests (each fails without its fix): event_record_carries_stream_region (eu-west-2 + cn-north-1), archive_rule_on_custom_bus_carries_bus_in_arn (custom + default bus), created_and_implicit_log_groups_describe_identically (+ EventBridge delivery assertions).
• cargo check --workspace --all-targets; cargo test on cloudformation, logs, eventbridge, the server binary and bedrock-agent-runtime; clippy -D warnings; fmt.

---

Summary by cubic

Fixes four correctness issues found while auditing ARN handling across services.

Four independent fixes:

• Kinesis event-source records: awsRegion was hardcoded to us-east-1; now taken from the stream ARN.
• EventBridge archives: CreateArchive built the managed rule ARN in the default-bus form even for custom-bus archives; it now puts the source bus in the ARN, matching AWS.
• CloudWatch Logs ARN forms: CreateLogGroup stored group ARNs with a trailing :*, while implicitly created groups stored them without. All creation paths now store the same :* form, and readers use the suffix-less form for logGroupArn/logGroupIdentifier and stream ARNs. Older snapshots in either form still resolve.
• Bedrock agent runtime: Identifier regexes are now compiled once via LazyLock instead of on every request. Patterns unchanged.

Migration

• No surface changes or migration steps; older snapshots continue to work.

^{Written for commit c130ba0. Summary will update on new commits.}