fix(moa): route bedrock MoA slots through signed bedrock branch

[iizotov]

Summary

MoA presets that use a Bedrock model as the aggregator (or as a reference) fail: the aggregator turn returns an empty/malformed ChatCompletion (choices=None), which trips the auxiliary response validator and aborts the turn.

Root cause

_slot_runtime() in agent/moa_loop.py resolves each MoA slot to its real runtime and, for most providers, forwards the resolved base_url + api_key to call_llm. A small name-preserve set (nous, openai-codex, xai-oauth) is exempted because their auth isn't a forwardable bearer token.

Bedrock was missing from that set. resolve_runtime_provider returns:

• api_mode = anthropic_messages
• base_url = https://bedrock-runtime.<region>.amazonaws.com
• api_key = "aws-sdk" ← a placeholder, not a real token (auth is AWS SigV4 / IAM-role signing)

So _slot_runtime forwarded the bedrock-runtime URL plus the fake "aws-sdk" key. call_llm then treated it as a plain OpenAI-compatible endpoint and issued an unsigned bearer POST to the Bedrock runtime. Bedrock answered with an empty/malformed ChatCompletion, failing .choices[0].message validation.

References using real bearer tokens (e.g. openai-codex, custom xAI) survived because their auth works through the forwarded path; only Bedrock's SigV4 path broke.

Fix

Add bedrock to the name-preserve set so bedrock slots are passed by provider name only, routing through call_llm's dedicated SigV4-signed bedrock branch (the same branch the main agent already uses successfully).

if resolved_provider in {"nous", "openai-codex", "xai-oauth", "bedrock"}:
    return out

Verification

• _slot_runtime({provider:"bedrock", ...}) now returns only ['provider','model'] — no leaked base_url / placeholder key.
• Direct call_llm(provider="bedrock", ...) aggregator call returns a valid completion.
• Full aggregate_moa_context() end-to-end with a bedrock aggregator now produces a complete synthesis instead of an empty ChatCompletion.

Impact

Affects any MoA preset with a bedrock aggregator or bedrock reference. No effect on non-bedrock providers.

[tonydwb]

Code Review Summary

Verdict: LGTM

Clean, well-scoped change with no concerns.

--- Reviewed by Hermes Agent

[teknium1]

Merged via #55897 — your commit was cherry-picked onto current main with your authorship preserved in git log.

The bedrock case is the same class as the OAuth providers: the provider branch builds an AWS-SigV4-signed client, and resolve_runtime_provider returns a placeholder api_key ("aws-sdk") with no real bearer — so forwarding base_url/api_key produced an unsigned POST and an empty/malformed ChatCompletion. #55897 adds bedrock to the _slot_runtime name-preservation set as you did, bundled with the anthropic fix (#54609). Thanks!