Greptile Summary

This PR fixes a bug where Bedrock (and other implicit provider) discovery silently failed when AWS credentials were configured via openclaw.json env.vars rather than the host shell environment. The root cause was that ensureOpenClawModelsJson could be called by agent runners, tools, and compaction with a config object that hadn't passed through the full loadConfig() pipeline, so applyConfigEnvVars was never called and process.env was never populated with config-defined vars before resolveImplicitProviders / resolveImplicitBedrockProvider ran.

Changes:

• Adds applyConfigEnvVars(cfg) at the top of ensureOpenClawModelsJson, before the implicit provider discovery calls.
• The fix is idempotent — applyConfigEnvVars is a no-op for vars already present in process.env — so there is no risk of double-application when called from a code path that already went through loadConfig().
• No new test covering the specific scenario (config-only AWS credentials triggering Bedrock discovery) is included; the manual test step in the PR checklist is still unchecked, but the change is simple and the existing test suite validates surrounding logic.

Confidence Score: 5/5

• This PR is safe to merge — the change is minimal, targeted, and idempotent with no risk of regressions.
• The fix is a single, well-understood function call (applyConfigEnvVars) that is already used in the same pattern within loadConfig(). The function is idempotent by design (skips vars already set in process.env), so calling it on code paths that already went through loadConfig() is harmless. All 68 existing models-config tests and 6 config.env-vars tests pass. The only gap is that no automated test covers the exact regression scenario (config-only AWS credentials → Bedrock discovery), but the change is simple enough that the risk is very low.
• No files require special attention.

_{Last reviewed commit: 1a51276}

Landed via temp rebase onto main.

• Gate: pnpm test -- src/agents/models-config.applies-config-env-vars.test.ts src/agents/models-config.skips-writing-models-json-no-env-token.test.ts src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts
• Note: full pnpm check is currently red on unrelated main-branch failures in extensions/tlon and src/discord, src/media-understanding, src/security type checks.
• Land commit: b53b0c1
• Merge commit: 1e8afa1

Thanks @hsiaoa!