feat: support Amazon Bedrock through the AWS SDK credential chain

[kabigon-1015]

Summary

Adds a provider input (openai (default) | amazon-bedrock) so Codex can run against OpenAI models on Amazon Bedrock, authenticating through the AWS SDK credential chain — e.g. short-lived OIDC credentials from aws-actions/configure-aws-credentials — with no long-lived keys stored in the repository.

Addresses #107.

permissions:
  id-token: write
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/codex-bedrock-role
      aws-region: us-east-1
  - uses: openai/codex-action@v1
    with:
      provider: amazon-bedrock
      model: openai.gpt-5.6-sol
      permission-profile: ":read-only"
      prompt: "Review the public change."

Design notes

• No credential inputs, no credential forwarding. The Codex CLI already resolves AWS credentials and region through the SDK credential chain (env, OIDC web identity, shared config, instance role, AWS_BEARER_TOKEN_BEDROCK), and runCodexExec spawns codex with the inherited environment. The action only selects the provider (--config model_provider="amazon-bedrock") and validates inputs. This keeps the action-side surface minimal and supports every auth method the CLI supports, including enterprise setups where long-lived keys are prohibited.
• Read server info is skipped for Bedrock. Its current condition (openai-api-key != '' || prompt != '') makes any keyless run with a prompt poll for a server-info file that no proxy ever writes, then fail. This gating fix is required for any proxy-less provider to work.
• Hardening stays on. drop-sudo, its verification, and the user-namespace setup for the sandbox now also run for the Bedrock path.
• Fail fast on misconfiguration: openai-api-key combined with provider: amazon-bedrock is rejected (the proxy and the credential chain are mutually exclusive by design), as is a missing AWS_REGION/AWS_DEFAULT_REGION.
• codex-args still wins. The provider config is pushed before extraArgs, so callers can layer provider settings such as model_providers.amazon-bedrock.aws.profile.

Relationship to #111

#111 pioneered the provider input (thank you @Suto-Michimasa!). This PR takes a different approach to authentication — delegating entirely to the AWS SDK credential chain instead of validating/forwarding specific credential env vars — and additionally fixes the Read server info gating that otherwise fails a keyless run. Happy to converge the two PRs in whichever direction the maintainers prefer.

Known limitations (documented)

• safety-strategy: unprivileged-user is not supported with Bedrock: sudo resets the environment, so chain-resolved credentials do not reach the Codex process. The README directs users to drop-sudo/read-only.
• Because there is no proxy, credentials are visible to the Codex process; docs/security.md now recommends short-lived OIDC credentials scoped to Bedrock inference only.

Verification

• pnpm run check / pnpm run build / pnpm test (4 new unit tests covering the provider flag, default behavior, codex-args ordering, and invalid-provider rejection)

• End-to-end run on GitHub Actions (ubuntu-latest), pinned to this branch's head SHA: OIDC → aws-actions/configure-aws-credentials (no long-lived keys, no AWS_BEARER_TOKEN_BEDROCK) → provider: amazon-bedrock / model: openai.gpt-5.6-luna / sandbox: read-only. The job succeeded end to end; sanitized log excerpt:

  # proxy install / "Read server info" steps: skipped (no openai-api-key)
  Confirmed sudo privilege is disabled.
  Running: CODEX_HOME=/home/runner/.codex codex "exec" "--skip-git-repo-check" \
    "--cd" "..." "--output-last-message" "..." \
    "--model" "openai.gpt-5.6-luna" \
    "--config" "model_provider=\"amazon-bedrock\"" "--sandbox" "read-only"
  codex> pong
  final-message: pong   # propagated through the action output
  

  This confirms the credential chain path works with OIDC-issued temporary credentials only, the proxy steps are cleanly skipped, and the drop-sudo hardening still runs for the Bedrock path.

🤖 Generated with Claude Code

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[kabigon-1015]

I have read the CLA Document and I hereby sign the CLA