AWS Bedrock as agent model backend

[kmendler]

Motivation

No way to point Buzz agents at models served through Amazon Bedrock. Teams running Buzz self-hosted in AWS want this to draw down Bedrock credits, keep inference inside their AWS account (data residency), and reach the model families Bedrock hosts without depending on a single vendor's public API. We hit it deploying Buzz internally: we have AWS credits and a data-residency constraint, but the only path to Bedrock today is an external proxy.

Proposed solution

A first-class Bedrock provider, selectable per agent like the others, with:

• AWS region (+ cross-region inference profiles),
• credential source: IAM role, SSO profile, or access keys — via SigV4, not a bearer key,
• model ID selection, with live listing where account access allows.

Ideally preserving native features (e.g. Anthropic prompt caching) the way the Databricks path in #3463 does.

Alternatives considered

• Custom raw base-URL provider (Goose harness "Custom provider" (raw base-URL) integration is broken #2749): can't work — bearer-token only, while Bedrock needs SigV4 signing and region-scoped model IDs (and it's reported broken).
• LiteLLM/OpenAI-compat proxy → Bedrock: works but adds a service to run and usually drops provider-native features.
• Call the Anthropic API directly: defeats the cost + data-residency goals.

Additional context

Prior art: #3463 added Anthropic prompt caching for Databricks — Buzz already models enterprise LLM gateways, and Bedrock is the AWS-native analog.
Duplicate check: none found (searched open + closed issues and PRs).