fix(claude): support custom HTTP clients for Bedrock

[March-77]

What type of PR is this?

fix

Check the PR title.

• This PR title match the format: <type>(optional scope): <description>
• The description of this PR title is user-oriented and clear enough for others to understand.
• Attach the PR updating the user documentation if the current PR requires user awareness at the usage level. No documentation update is required for this bug fix.

(Optional) Translate the PR title into Chinese.

N/A

(Optional) More detailed description for this PR(en: English/zh: Chinese).

en:

• load the AWS configuration directly so CA bundle failures are returned from NewChatModel instead of panicking inside bedrock.WithLoadDefaultConfig
• preserve the configured HTTP client for AWS configuration and credential requests when AWS can use it directly; retry with an AWS BuildableClient only when custom CA bundle resolution requires it
• pass the original client to the Anthropic SDK so actual Bedrock model requests retain custom transports, timeouts, redirects, and other client behavior
• add offline regression coverage for valid and invalid CA bundles, a non-standard RoundTripper, Web Identity/STS credential retrieval, request signing, and the final Bedrock request

This supersedes the closed, unmerged #717 by covering both the API request path and the AWS_CA_BUNDLE incompatibility.

Validation:

• GOTOOLCHAIN=go1.25.6 go test -gcflags="all=-N -l" ./... -count=1
• targeted regression tests repeated 20 times
• GOTOOLCHAIN=go1.25.6 go vet ./...
• golangci-lint run --no-config --default=standard --new-from-rev=origin/main ./...

zh(optional): N/A

(Optional) Which issue(s) this PR fixes:

Fixes #712

(optional) The PR that updates user documentation:

N/A

[March-77]

Revalidated on 2026-08-23 against current main (6752ff8):

• GitHub reports MERGEABLE. BLOCKED is solely the repository rule requiring one approving review; all five checks, including CLA, pass.
• A test merge of current main is clean (the branch is 12 main commits behind). The six later main commits touching the Claude module concern cache/callback data and schema panic handling; none covers Claude Bedrock: Config.HTTPClient causes panic with AWS_CA_BUNDLE + is ignored for API calls #712.
• With Go 1.25.6: the five Bedrock HTTP-client regressions passed 10x under race with the mockey-compatible gcflags; go test ./... and go vet ./... also pass.
• The tests cover CA-bundle success/error handling, a non-standard RoundTripper, Web Identity/STS credential retrieval, SigV4 signing, and the final Bedrock request using the injected client. I also ran an uncommitted 32-goroutine shared-model/custom-client test 20x under race; it passed without races or lost requests. The AWS fallback clones a standard transport rather than mutating the caller client, and the newly imported AWS root module is correctly promoted to a direct dependency.

No code update appears necessary; an approving review is the remaining blocker.