…orks#3125)

Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.

When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
   header with `Bearer <token>` and removes SigV4-specific headers

This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.

Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.

Required IAM permission on the token's identity:
  bedrock:CallWithBearerToken

Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.

…orks#3125)

Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.

When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
   header with `Bearer <token>` and removes SigV4-specific headers

This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.

Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.

Required IAM permission on the token's identity:
  bedrock:CallWithBearerToken

Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.

…orks#3125)

Adds bearer token authentication for the Bedrock Converse API, enabling
users to authenticate with an API key instead of SigV4/IAM credentials.

When a bearer token is available (via `options.bearerToken` or the
`AWS_BEARER_TOKEN_BEDROCK` env var), the provider:
1. Sets dummy credentials to prevent SDK credential resolution errors
2. Injects middleware after SigV4 signing that replaces the Authorization
   header with `Bearer <token>` and removes SigV4-specific headers

This uses the official `bedrock:CallWithBearerToken` IAM action, which
is a documented AWS feature for API key auth on Bedrock endpoints.

Use case: users who receive a Bedrock API key (bearer token) from the
AWS console or their admin, without having IAM access keys or instance
roles. Similar to how ANTHROPIC_API_KEY works for direct Anthropic API.

Required IAM permission on the token's identity:
  bedrock:CallWithBearerToken

Tested: Bearer token successfully authenticates against Bedrock Converse
API (returns correct 403 for missing IAM permission, not auth format error).
SigV4 path is unchanged when no bearer token is set.

Consolidates 62 upstream commits (v0.67.4 -> v0.67.68) into the fork.
Preserves all fork-local work (OAuth cloak, antigravity pool, context
tiers, OSC 8 file hyperlinks, gemini3 sig skip, codex_cli_rs headers,
compaction context hooks, gpt-5.4 models).

Conflict resolutions (4 files):

- packages/ai/src/providers/google-gemini-cli.ts: layered upstream's
  onResponse hook call into our pool-aware retry loop; kept our
  finally-block pool.saveNow() path.

- packages/tui/src/utils.ts: adopted upstream's AnsiCodeTracker OSC 8
  impl wholesale. It's cleaner than our f16dfd5 version (preserves
  hyperlink across SGR reset via separate clear(), emits ST-terminated
  sequences). Dropped our 7d75fee SEGMENT_RESET fix since upstream's
  design never introduced the bug.

- packages/tui/src/components/markdown.ts: kept our resolveHref hook
  and wrapHyperlink helper but gated OSC 8 emission on
  getCapabilities().hyperlinks; switched to upstream's hyperlink()
  helper for consistency. Merges file path linking (ours) with
  terminal capability detection (upstream earendil-works#3248, #30a8a41f).

- packages/tui/test/{markdown,wrap-ansi}.test.ts: updated our OSC 8
  assertions to ST-terminated sequences (\x1b\\) to match new emitter;
  added setCapabilities({hyperlinks:true}) gating where needed;
  afterEach resetCapabilitiesCache to isolate test state.

Dependency upgrades from upstream:
- @anthropic-ai/sdk 0.73.0 -> 0.90.0
- @aws-sdk/client-bedrock-runtime 3.983.0 -> 3.1030.0
- @mistralai/mistralai 1.14.1 -> 2.2.0

Upstream features folded in:
- fix(ai): Opus 4.7 adaptive thinking + xhigh effort (earendil-works#3286)
- feat(ai): thinkingDisplay option (summarized/omitted/raw)
- feat(coding-agent): after_provider_response hook (earendil-works#3128)
- fix(ai): trust requested Codex service tier (earendil-works#3307)
- feat(bedrock): Bearer token auth for Converse API (earendil-works#3125)
- feat(agent,coding-agent): per-tool executionMode override (earendil-works#3345)
- feat(tui): OSC 8 hyperlinks with terminal capability detection
  (earendil-works#3248, #30a8a41f)
- feat(coding-agent,tui): argument-hint frontmatter in prompts (earendil-works#2780)
- Plus ~40 smaller fixes across ai/coding-agent/tui/agent.

Verification:
- packages/tui: 559/559 tests pass
- packages/ai: 144/144 OAuth cloak tests pass; all fork-local suites
  pass (antigravity-pool, context-tiers, gemini3-unsigned-tool-call,
  codex-stream, supports-xhigh, etc.). Remaining test failures (13)
  are pre-existing live-API E2E tests (no credentials in this env).
- packages/agent: 39/39 tests pass.
- packages/coding-agent: 1020/1021 tests pass; 1 flaky bash timeout
  test (passes in isolation), unrelated to merge.
- All four packages build cleanly.