fix(sagemaker): Add proactive credential refresh for SSO-based SageMaker Space connections

[amzn-kvk]

Problem

When connecting to a SageMaker Space via IAM Identity Center (SSO), the session disconnects after ~1 hour. Active Jupyter kernels are killed and the user must re-authenticate via browser and reload the window.

The root cause is that persistLocalCredentials() snapshots STS credentials once at connection time and writes them as static strings to ~/.aws/.sagemaker-space-profiles. The detached server's resolveCredentialsFor() returns these values as-is with no expiry check or re-derivation. After ~1 hour (default STS credential TTL), the SSM tunnel drops and reconnection fails because the mapping file contains expired credentials.

This only affects SSO connections:

• IAM connections are unaffected because the detached server calls fromIni({ profile }) which resolves dynamically.
• SMUS connections are unaffected because persistSmusProjectCreds() calls startProactiveCredentialRefresh() which periodically writes fresh credentials to the mapping file.

Solution

Add SsoCredentialRefresher that follows the proven SMUS ProjectRoleCredentialsProvider.startProactiveCredentialRefresh() pattern:

• Checks every 10 seconds using setTimeout (handles sleep/resume correctly)
• Refreshes when credentials expire within 5 minutes (safety buffer)
• Writes fresh credentials to ~/.aws/.sagemaker-space-profiles via setSpaceSsoProfile()

persistLocalCredentials() now starts the refresher for SSO connections after the initial credential write. The detached server and SSH ProxyCommand are unchanged - they continue reading from the mapping file, which now stays fresh.

Files changed:

• credentialMapping.ts - Added SsoCredentialRefresher class; wired into persistLocalCredentials() for SSO
• ssoCredentialRefresh.test.ts - 4 tests covering refresh on expiry, skip when fresh, end-to-end read, and SSO/SMUS parity

---

• Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
• Your code changes must meet the guidelines in CONTRIBUTING.md.
• License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

[amazon-inspector-ohio]

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

[github-actions]

• This pull request implements a feat or fix, so it must include a changelog entry (unless the fix is for an unreleased feature). Review the changelog guidelines.
  • Note: beta or "experiment" features that have active users should announce fixes in the changelog.
  • If this is not a feature or fix, use an appropriate type from the title guidelines. For example, telemetry-only changes should use the telemetry type.

[amazon-inspector-ohio]

✅ I finished the code review, and didn't find any security or code quality issues.

[yuriivv]

/retryBuilds