…CommandOptions (#1232)

Fixes #1231

When an integration test specifies a profile via
`cdkCommandOptions.deploy.args.profile`:

```typescript
new IntegTest(app, 'my-test', {
  testCases: [myStack],
  cdkCommandOptions: {
    deploy: {
      args: { profile: 'deploy-profile' },
    },
  },
});
```

The profile is silently ignored. The `ToolkitLibRunnerEngine` creates a
single `Toolkit` instance at construction time with credentials locked
to the runner-level profile (from `--profiles` CLI flag or machine
default). The engine's `deploy()` and `destroy()` methods receive the
correct profile in their options but never use it.

This capability existed implicitly in the old `cli-wrapper` engine
(removed in #1108) which spawned separate CLI processes per action, each
with its own `--profile` flag.

#### Changes

Single file: `packages/@aws-cdk/integ-runner/lib/engines/toolkit-lib.ts`

- Extracted `createToolkit(profile, region)` helper from the constructor
- Added `toolkitFor(options)` that returns a new `Toolkit` when the
per-action profile differs from the constructor profile, or reuses the
existing one when they match
- Updated `deploy()`, `destroy()`, and `cx()` to use the appropriate
toolkit

#### Testing

Added 3 tests in
`packages/@aws-cdk/integ-runner/test/engines/toolkit-lib.test.ts`:

- Deploy with override profile creates new Toolkit with correct
credentials
- Destroy with override profile creates new Toolkit with correct
credentials
- Deploy with same profile reuses existing Toolkit (no perf regression)

All 149 existing tests continue to pass.


### Checklist
- [ ] This change contains a major version upgrade for a dependency and
I confirm all breaking changes are addressed
  - Release notes for the new version:

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license

---------

Co-authored-by: Sai Ray <[email protected]>

…onfiguration (#1306)

Fixes #1305

`integ-runner` now supports `--proxy` and `--ca-bundle-path` CLI options
to configure proxy settings for all AWS API calls. When no `--proxy`
flag is given, proxy settings are auto-detected from
`HTTPS_PROXY`/`HTTP_PROXY` environment variables. The `--ca-bundle-path`
option reads a PEM certificate bundle, falling back to the
`AWS_CA_BUNDLE` environment variable. Both options can also be set via
`integ.config.json`.

Previously, `ToolkitLibRunnerEngine` did not pass proxy or CA bundle
options to the `Toolkit` constructor's `sdkConfig`. The AWS SDK v3's
`NodeHttpHandler` creates its own `https.Agent` which bypasses proxy
environment variables, so a proxy-aware agent must be explicitly
provided. This became a regression when the toolkit-lib engine became
the default in #906 and the old CLI engine was removed in #1108. The old
engine spawned `cdk` as a child process which handled proxy settings
internally. The new engine runs in-process but never wired up the proxy
configuration.

The fix uses `proxy-agent` (the same library as the CDK CLI) to create
proxy-aware agents that are passed as `sdkConfig.httpOptions.agent` to
the Toolkit constructor. Both `ProxyAgent` and `Toolkit` instances are
cached by their resolved configuration to avoid creating duplicates
across engine instances. Per-action options from `DefaultCdkOptions` can
override the engine defaults through a dedicated `ActionOptions`
interface.

### Checklist
- [ ] This change contains a major version upgrade for a dependency and
I confirm all breaking changes are addressed
  - Release notes for the new version:

---
By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license