Add Bedrock and SageMaker idle capacity rules

[dannysteenman]

What

Rules for idle ML capacity: Bedrock provisioned throughput with no invocations, and SageMaker Studio apps left running.

Why

Bedrock provisioned throughput (provisioned model units) is among the most expensive idle capacity on AWS today — commitments run thousands of dollars per month per model unit whether invoked or not — and it's increasingly common as teams experiment with GenAI. SageMaker Studio kernel/app instances left running are the Studio-era version of the notebook-instance waste CLDBRN-AWS-SAGEMAKER-1 already flags.

Details

1. Bedrock provisioned throughput with zero (or negligible) invocations over the lookback window — discovery; new bedrock/ module, CLDBRN-AWS-BEDROCK-1. Research: confirm Resource Explorer support for provisioned model throughput; if unsearchable, use an account-level dataset per the costguardrails pattern rather than a new region fan-out (architecture boundary).
2. SageMaker Studio app (KernelGateway/JupyterServer/CodeEditor) in InService beyond an idle threshold — discovery; extends sagemaker/ as CLDBRN-AWS-SAGEMAKER-3.
3. Optional: SageMaker endpoint on a real-time instance whose traffic fits serverless inference — review severity; boundary with SAGEMAKER-2 (idle endpoint) defined during research.