Harden Bedrock credentials and preserve AWS region provenance

[wch]

Follow-up to #49 with two commits that were made locally after that PR's branch was last pushed, so they missed the squash merge:

• Harden Bedrock discovery and credentials — adds an update-aws variant to CredentialMutation in ai-credentials (region/profile update with replace/clear/preserve semantics for manual keys), implements it in the store backend, and hardens the Bedrock provider's inference-profile discovery and credential handling.
• Preserve AWS region configuration provenance — ai-config now exposes connectionProvenance on resolved providers, recording whether the effective AWS region came from deliberate configuration or only ambient AWS_REGION env. Downstream (assistant monorepo) uses this so a region-only shell setting doesn't mark Bedrock as configured.

These changes are required by the assistant monorepo's aws-regions work (posit-dev/assistant#2002); its packages/node auth code already references update-aws and connectionProvenance.