fix(bedrock): preserve bearer token env compatibility

[skamenan7]

Summary

• preserve compatibility after the intentional Bedrock bearer-token rename to AWS_BEDROCK_BEARER_TOKEN
• keep AWS_BEDROCK_BEARER_TOKEN as the canonical documented Bedrock bearer token env var
• add fallback support for the legacy AWS_BEARER_TOKEN_BEDROCK env/config name where older callers, CI secrets, or local scripts may still provide it
• pass both bearer-token names through integration and record workflows so existing secrets continue to work during the transition
• add an optional Bedrock recording path for the STS web identity auth introduced in feat(bedrock): add AWS SigV4 and STS web identity authentication #5388, gated by an AWS_BEDROCK_ROLE_ARN GitHub secret
• pass standard AWS credential-chain env vars through Docker integration test runs

Context

This compatibility gap came up while looking at #6106-related CI/re-recording follow-up, but #6106 is not the cause of the rename. The Bedrock env var rename was intentional and documented as part of the AWS-native auth naming work.

The failed re-record job showed AWS_BEDROCK_BEARER_TOKEN was set but Bedrock rejected that credential, so the immediate failure still looks like a stale/invalid bearer token. Separately, #5388 already added SigV4 + STS web identity support in the provider, but the record workflow had not prepared AWS_ROLE_ARN/AWS_WEB_IDENTITY_TOKEN_FILE for Bedrock. This PR wires that optional workflow path without removing the current bearer-token fallback.

Test Plan

• uv run pytest tests/unit/providers/inference/test_bedrock_config.py tests/unit/providers/inference/bedrock/test_sigv4_auth.py -q
• uv run pre-commit run check-yaml --files .github/workflows/record-integration-tests.yml
• uv run pre-commit run actionlint --files .github/workflows/record-integration-tests.yml
• pre-commit via git commit hooks

[cdoern]

I wonder, is this why the bedrock re-recording failed?

[skamenan7]

I wonder, is this why the bedrock re-recording failed?

@cdoern I don’t think the failed re-record is caused directly by the env var rename. The job env showed
AWS_BEDROCK_BEARER_TOKEN was set, and the error looks like Bedrock rejected the provided credential value.

I opened this PR as a small compatibility follow-up anyway: it keeps AWS_BEDROCK_BEARER_TOKEN as the canonical documented name, but also accepts/passes through the legacy AWS_BEARER_TOKEN_BEDROCK name so older CI/local paths don’t silently fall back to SigV4/no-token behavior during the transition.