fix(bedrock): register AWS credential env vars in subprocess credential blocklist

[HiddenPuppy]

Summary

This PR fixes a security issue where AWS credential environment variables leak to agent-spawned subprocesses (terminal, execute_code, MCP servers) when using AWS Bedrock as the inference provider.

Root Cause

In hermes_cli/auth.py, the built-in Bedrock ProviderConfig is defined with api_key_env_vars=() (empty tuple). The subprocess environment blocklist builder in tools/environments/local.py (_build_provider_env_blocklist()) only consumes api_key_env_vars from each provider config:

for pconfig in PROVIDER_REGISTRY.values():
    blocked.update(pconfig.api_key_env_vars)

Since bedrock's tuple was empty, none of the standard AWS SDK credential environment variables were ever added to _HERMES_PROVIDER_ENV_BLOCKLIST, causing them to leak to all subprocesses.

Impact

• Subprocesses (terminal, execute_code, MCP servers, agent delegations) silently inherit AWS credentials
• Tools that enumerate available models (e.g., opencode models) show Bedrock models inadvertently
• If AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY leak, subprocesses inherit all of the user's AWS capabilities
• Cost-incurring API calls may occur without the user's awareness

Fix

Add the standard AWS SDK credential environment variables to the Bedrock ProviderConfig.api_key_env_vars:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN
• AWS_BEARER_TOKEN_BEDROCK
• AWS_PROFILE
• AWS_DEFAULT_REGION
• AWS_ROLE_ARN
• AWS_WEB_IDENTITY_TOKEN_FILE

The auth_type=\"aws_sdk\" field is already defined on the bedrock config; the blocklist builder already iterates all providers. The only gap was that no AWS credential env vars were listed.

Closes #32314

[alt-glitch]

Duplicate of #32319 — both fix #32314 (AWS credential env var leak on Bedrock). Note: #32319 covers 10 AWS vars (including container credential vars) and includes regression tests, while this PR covers 8 vars with no tests. The approaches are complementary (auth.py data fix vs local.py explicit blocklist) but #32319 is more comprehensive.

[teknium1]

Superseded by #34498 (merged to main). Thanks for working #32314.

Two reasons we went a different way: (1) stuffing AWS vars into api_key_env_vars pollutes the agent-init hint strings and credential_pool probes with non-API-key entries — so the merged fix uses a separate auth_type=="aws_sdk"-keyed set instead; and (2) the merged fix narrows the strip to AWS_BEARER_TOKEN_BEDROCK only and leaves the general AWS chain (incl. AWS_DEFAULT_REGION, which isn't a credential) inheritable, so users who run aws/terraform/boto3 in the agent terminal aren't regressed. Per SECURITY.md §3.2 the local terminal is the user's trusted operator shell. Appreciate it.