#9967 fix(aws): round-trip typed DynamoDB cursors and allow percentile-only CloudWatch statistics

Summary

Fixes from the v0.9.55 release review (#9963) that touch the AWS sweep (#9952/#9961).

• DynamoDB pagination cursors round-trip for every key type.
  • lastEvaluatedKey encoded integers a JS number can't hold, and binary keys, as plain strings. Passed back as exclusiveStartKey, they went out as S, so fetching the next page failed the key type check.
  • The cursor now encodes those values as { N } / { B } (key attributes are always scalar, so this can't collide with a real key value), and exclusiveStartKey decodes them back to NumberValue / binary.
  • String and safe-number cursors are unchanged, and item output is byte-identical.
  • Not a regression from main, where these tables failed on page 1 (BigInt serialization).
• CloudWatch get_metric_statistics accepts percentile-only requests.
  • statistics is optional on the tool and in the contract, which now requires at least one of statistics / extendedStatistics.
  • Direct and agent calls that pass only extendedStatistics no longer fail the required-param check.
  • The block is unchanged: its Statistics field is still required and always populated, and ExtendedStatistics still takes precedence when both are set.

Not changed: the review note on dynamodb-get (expression attribute names without a projection) doesn't apply. tools/dynamodb/get.ts only forwards names together with a projection, and the contract has no other caller.

Type of Change

• Bug fix

Testing

• New regression tests, each red on the pre-fix code:
  • DynamoDB cursor round trip: large-number and binary keys come back as N/B, while strings and safe numbers are unchanged.
  • CloudWatch percentile-only request: passes the required-param check and the contract.
  • The "neither statistic" rejection, pinned to the refine and guard-revert checked.
• vitest across DynamoDB, CloudWatch, the AWS contracts, the stale-input test and the block tests: 45 passed.
• check-block-registry.ts origin/staging, check:tool-metadata, check:docs, check:integration-catalog, check:unused-exports, check:utils, check:test-patterns, check:explicit-any, check:api-validation:strict and biome pass.
• /simplify and /cleanup run on the diff.
• Type-check runs in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)