fix(bedrock): picker shows Bedrock after switching away when using IAM role auth

[iller75]

Problem

Closes #45838.

When a user switches from Bedrock to another provider (Anthropic, OpenRouter, etc.) and then opens /model again, Bedrock is absent from the list.

Root cause: _has_aws_sdk_creds_for_listing() in list_authenticated_providers() has two gates:

1. Fast env-var signal (AWS_ACCESS_KEY_ID, AWS_PROFILE, etc.) — returns False on IAM instance role auth since no AWS_* vars are set
2. Fallback: slug == current_provider guard before calling has_aws_credentials()

After switching away from Bedrock, current_provider is now e.g. "anthropic". Gate 2 short-circuits ("bedrock" != "anthropic"), has_aws_credentials() is never called, and Bedrock disappears from the picker.

Fix

Remove the slug != current_provider guard. has_aws_credentials() already does a fast env-var check internally before touching botocore/IMDS — calling it unconditionally is safe and covers all auth paths: env vars, ~/.aws/credentials, IAM instance roles, ECS task roles, etc.

# Before
def _has_aws_sdk_creds_for_listing(slug: str) -> bool:
    slug_norm = str(slug or "").strip().lower()
    current_norm = str(current_provider or "").strip().lower()
    if _has_fast_aws_sdk_signal():
        return True
    if slug_norm != current_norm:   # <-- breaks IAM role users after switching away
        return False
    ...

# After
def _has_aws_sdk_creds_for_listing(slug: str) -> bool:
    if _has_fast_aws_sdk_signal():
        return True
    try:
        from agent.bedrock_adapter import has_aws_credentials
        return bool(has_aws_credentials())
    except Exception:
        return False

Tests

• Updated test_non_bedrock_picker_does_not_probe_full_aws_chain → renamed and corrected to reflect new behaviour (Bedrock hidden when has_aws_credentials() returns False, regardless of current provider)
• Added test_bedrock_appears_after_switching_away_iam_role: regression test for the exact scenario — current_provider="anthropic", no AWS env vars, IAM role returns True → Bedrock must appear

All 22 tests in test_bedrock_model_picker.py pass.

[alt-glitch]

Related: #45838 (the issue this closes), #45896 and #45943 (competing open fixes for the same picker-omission symptom, at different sites: cli.py requested_provider and main.py config-provider), and merged #49380 (broader stale-credential clearing across provider switches).

This PR fixes a distinct code path — the slug != current_provider short-circuit in _has_aws_sdk_creds_for_listing() (hermes_cli/model_switch.py) that hides Bedrock for IAM-instance-role users after switching away — so it's complementary to the other picker fixes, not a duplicate.

[teknium1]

Thanks for isolating a real current-main omission: hermes_cli/model_switch.py:1617-1618 does hide Bedrock when an IAM-role user has switched to another provider.

Problems

• The proposed removal reverses the guard introduced by d409a4409c8f11ccf029eff33a2eb9860f92e761 (fix(model): avoid bedrock credential probe in provider picker). That guard exists because picker opens for non-Bedrock providers must not enter botocore’s full credential chain.
• With no fast AWS signal, this change reaches implicit credential resolution at agent/bedrock_adapter.py:310-319 and 343-350, including possible EC2 IMDS access, for ordinary unrelated picker opens. The changed test intentionally drops the existing no-probe contract at tests/hermes_cli/test_bedrock_model_picker.py:219-241.

Suggested changes

• Preserve the non-Bedrock no-probe behavior and implement IAM-role re-discovery through a bounded/explicit path that does not synchronously probe AWS credentials on every picker render. Add the switch-away regression against that design.

Automated hermes-sweeper review.

[teknium1]

This guard was deliberately added by d409a4409 to keep non-Bedrock picker opens out of botocore's full credential chain. Removing it makes no-env picker renders reach implicit credential resolution (including potential IMDS probing); please preserve that no-probe invariant and use a bounded IAM-role discovery path instead.