feat(aws-transform): add .NET bulk / multi-repo modernization steering

[pranav-firake]

Summary

Routes portfolio / multi-repo .NET requests to the bulk orchestrator (dotnet-bulk-modernization-agent) instead of the single-job flow.

The existing references/dotnet.md only describes the single-job dotnet-chatty-agent flow: one uploaded solution, local diff-apply, no separate assessment phase. The bulk orchestrator is a materially different model, and the skill had no steering for it:

	Single-job (existing)	Bulk / portfolio (new)
Orchestrator	dotnet-chatty-agent	dotnet-bulk-modernization-agent
Input	one uploaded source.zip	connector-based multi-repo discovery (CodeConnections / S3)
Phases	one job (assessment + transform)	distinct assessment → plan → transform
Review panels	none	discovered-repo selector, assessment summary, cross-repo selector, uber transformation plan, missing packages
Execution	local diff-apply	per-repo transform waves, web-delivered artifacts

Because both agents surface in chat as ".NET modernization agent", a portfolio request could be routed to the single-job flow, which cannot handle a fleet.

Changes

• New plugins/aws-transform/skills/aws-transform/references/dotnet-bulk.md — documents the portfolio flow. The orchestrator is discovered via list_resources (never hardcoded) and disambiguated on name = dotnet-bulk-modernization-agent only — not on jobOrchestrator / chatUILabel, which are not reliable selectors. HITL payloads defer to the runtime _outputSchema / _responseHint per tools.md; auth defers to auth.md.
• plugins/aws-transform/skills/aws-transform/references/workflow.md — routing now splits .NET by scope: a single local solution → dotnet.md; multi-repo / portfolio → dotnet-bulk.md.

Notable correctness details

• jobName uses "DotNet Bulk Modernization", not ".NET Bulk Modernization" — a leading . fails CreateJob's ^[\p{L}\p{N}]+(?:[-_\. ]+[\p{L}\p{N}]+)*$ pattern and raises ValidationException at runtime.
• The objective's interactive_mode MUST stay "auto" in the bulk flow. There it controls the per-repo sub-agent, which has no reviewer and idles out — writing "interactive" wedges the repo and the whole wave. An interactive selection is realized via the orchestrator mode gate instead.
• A declined connector approval lands in REJECTED with no path back to PENDING; create a fresh connector and delete the rejected one to free the workspace connector quota, rather than polling.
• connectorType: the Connector Control Plane enum is CODE_CONNECTION / S3, while the tool may expect a qualified connector id that it maps to that enum — read the tool schema rather than assuming either form.

Provenance

Mirrors the merged internal change (ATXKiroPower CR-300479961) into the public portable-plugin distribution, so plugin users get the same routing as the internal Power. Internal-only files (marketplace.json, test-prompts.json) are not included, and the .claude-plugin / .codex-plugin manifests are intentionally left untouched — upstream owns those (own version, keywords, author, interface), and the internal manifests carry an internal-only source_power_commit provenance field that has no meaning here.

Testing

• dprint check (0.51, repo dprint.json) — clean.
• markdownlint-cli2 (0.17, repo .markdownlint-cli2.yaml) — 0 errors.
• tools/validate-cross-refs.cjs — 0 errors.
• tools/validate-references.py — 0 broken links; dotnet-bulk.md is reachable from SKILL.md (not orphaned).
• tools/validate-size.py — 0 over the error threshold.
• ajv manifest validation — all manifests valid (unchanged).

Remaining warnings (SKILL.md at ~400 lines, AWSTransformInfrastructureExecutorAccessEC2.json orphan) are pre-existing on main and untouched by this PR.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[krokoko]

please update the version of the plugins where required