fix(dashboard): discover Bedrock IAM roles in profile builder

[qstyk-agent001-bot]

What does this PR do?

The dashboard Profile Builder now explicitly opts into the AWS SDK's full credential chain while loading model choices. This surfaces Bedrock models for EC2 users authenticated only through an IAM instance role, even when another provider is the current default.

The opt-in preserves the intentional safeguard from #18998: routine model picker opens still do not probe IMDS on machines without explicit AWS credential signals. This is a narrower alternative to the unconditional probing proposed in #50216.

Related Issue

Related: #50216

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Add an opt-in probe_cloud_credentials flag through the provider inventory and dashboard model-options endpoint.
• Have ProfileBuilderPage request the full cloud credential-chain probe.
• Keep the flag disabled by default for routine dashboard, TUI, and CLI picker opens.
• Add regression coverage for IAM-role discovery, default no-probe behavior, API forwarding, and the web API client.

How to Test

1. Run scripts/run_tests.sh tests/hermes_cli/test_bedrock_model_picker.py tests/hermes_cli/test_inventory.py tests/hermes_cli/test_web_server_profile_unification.py -q.
2. Run cd web && npm run typecheck && npm test && npx eslint src/lib/api.ts src/lib/api.test.ts src/pages/ProfileBuilderPage.tsx.
3. On EC2 with only an IAM instance role, open Dashboard → Profiles → New profile → Model and verify AWS Bedrock models appear while another provider remains the current default.

Checklist

Code

• I've read the Contributing Guide.
• My commit message follows Conventional Commits.
• I searched existing PRs and linked the overlapping proposal above.
• My PR contains only changes related to this fix.
• I've run the entire pytest tests/ -q suite locally. (The repository wrapper was attempted, but this checkout lacks the optional acp dependency and the ~44k-test run exceeded 10 minutes; focused hermetic suites pass.)
• I've added tests for my changes.
• I've tested on Amazon Linux 2023 on EC2 using an IAM instance role.

Documentation & Housekeeping

• Relevant docstrings are updated.
• cli-config.yaml.example update is N/A; no config keys changed.
• CONTRIBUTING.md / AGENTS.md update is N/A; no architecture or workflow changed.
• Cross-platform impact considered: the full SDK probe is opt-in and existing defaults are unchanged.
• Tool descriptions/schemas update is N/A.

Verification

Focused Python suites: 101 passed under scripts/run_tests.sh.

Web dashboard: 98 tests passed, TypeScript typecheck passed, and ESLint passed.

Live EC2 verification with model.provider=openai-codex and IAM-role-only AWS credentials:

bedrock_present=True
authenticated=True
model_count=135

An independent pre-commit review found no security concerns, logic errors, or suggestions.

[alt-glitch]

This was generated by AI during triage.

Related: #50216 restores IAM-role Bedrock discovery by probing all picker contexts; this patch confines the full credential-chain probe to the Dashboard Profile Builder. These are competing discovery contracts, not duplicate patches.

[teknium1]

Thanks for the narrowly scoped fix. Current main still returns early for Bedrock when it is not the active provider and no explicit AWS signal exists (hermes_cli/model_switch.py:2024-2032), while the AWS helper is specifically responsible for resolving implicit IAM-role credentials (agent/bedrock_adapter.py:325-353). The Profile Builder currently loads choices through the shared endpoint without this opt-in (web/src/pages/ProfileBuilderPage.tsx:98-121).

The proposed propagation is consistent with the existing no-probe regression contract for ordinary non-Bedrock picker opens (tests/hermes_cli/test_bedrock_model_picker.py:124-146) and does not introduce a configuration or core-tool surface. I found no substantive correctness issue in the PR diff.

Automated hermes-sweeper review.