fix(runtime): default omitted invoke user ID

[aidandaly24]

Summary

• default omitted Runtime invoke user IDs to default
• apply the fallback through the shared Runtime request normalizer used by direct, project, and TUI invocation
• document the default in direct and project invoke help

Testing

• bun test src/handlers/runtime/invoke/request.test.ts src/handlers/runtime/invoke/invoke.test.tsx src/handlers/runtime/invoke/invoke.screen.test.tsx src/handlers/project/invoke/index.test.tsx (83 pass)
• bun test src (2804 pass)
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• live AWS invocation against Issue686_Echo returned HTTP 200 without --user-id
• wire capture verified the signed request sends x-amzn-bedrock-agentcore-runtime-user-id: default, while an explicit --user-id overrides it

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

Small, focused fix that centralizes a "default" fallback for runtimeUserId in normalizeRuntimeInvokeRequest (src/handlers/runtime/invoke/request.ts), with matching help-text updates and test coverage.

Verified:

• All user-facing invoke entry points (runtime invoke headless + TUI screen, project invoke runtime) route through normalizeRuntimeInvokeRequest, so the default reaches both the CUSTOM_JWT header path and the IAM/SDK path in src/core/invokeRuntime.ts.
• src/core/eval.tsx intentionally builds its own RuntimeInvokeRequest and still forwards input.userId (potentially undefined). That's not covered by this change; since eval has its own userId semantics (per-example), leaving it out looks deliberate — worth confirming that's intended.
• Override test in request.test.ts still passes an explicit runtimeUserId through unchanged, and the screen test at invoke.screen.test.tsx:811 was updated correctly.

One thing to double-check (not a blocker): this is a behavior change — invocations that previously omitted X-Amzn-Bedrock-AgentCore-Runtime-User-Id will now always send default. Make sure that matches the server-side default and doesn't affect existing sessions/metrics that were keyed on "no user id".

Nothing else that requires changes before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.08%. Comparing base (16db5b4) to head (2791048).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2187   +/-   ##
=========================================
  Coverage     97.08%   97.08%           
=========================================
  Files           536      536           
  Lines         36979    36981    +2     
=========================================
+ Hits          35901    35903    +2     
  Misses         1078     1078           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

nit: should be get this from DEFAULT_RUNTIME_USER_ID.