feat(coderd_ai_provider): add Bedrock role_arn for STS assume-role

[ethanndickson]

Background

A customer running AWS Bedrock needs runtime IAM role assumption across multiple AWS accounts so usage bills to the correct account: a pod starts with its ambient AWS identity (IRSA / EKS Pod Identity / instance profile), then assumes a downstream role in another account via STS before calling Bedrock, with temp credentials cached and rotated by the AWS SDK. Static keys are not acceptable, and the base identity alone is insufficient since it's shared across providers.

This gap (AIGOV-371) was fixed server-side in coder/coder#26527 (backend: assume a configured role ARN via STS before calling Bedrock; whether the role is same- or cross-account is purely a matter of its trust policy) and coder/coder#26578 (web UI follow-up). The only piece reaching this provider is one new role_arn field on codersdk.AIProviderBedrockSettings, plus server-side ARN validation. Everything else lives in aibridge / coderd / cli / UI, which this provider doesn't import.

What this PR does

Adds an optional role_arn to coderd_ai_provider's settings.bedrock block so the assume-role workflow is configurable via Terraform, not only the UI. When set, the gateway uses its base identity to assume that IAM role via STS and signs Bedrock requests with the resulting temporary credentials; the role can live in the same account or a different one, depending entirely on its trust policy. A deployment that needs several roles configures several providers. Omitting it preserves today's behavior. Also updates the example and regenerates docs/.

SDK bump

role_arn isn't in any tagged codersdk release yet (latest v2.34.3 predates it), so go.mod is pinned to a pseudo-version of the coder/coder#26527 merge commit; re-pin to a real tag once one ships.

Closes CODAGT-607. Refs AIGOV-371. Refs coder/coder#26527, coder/coder#26578.

[ethanndickson]

• feat: add experimental coderd_default_agents_model resource #378
• test: migrate Docker orchestration to testcontainers-go #374
• feat(coderd_ai_provider): add Bedrock role_arn for STS assume-role #372 👈 (View in Graphite)
• feat: add experimental coderd_agents_model resource #371
• docs: add AGENTS.md contributor guide for AI agents #369
• feat: add experimental coderd_ai_provider resource #368
• ci: run acceptance tests against an external Postgres sidecar #370
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[linear-code]

AIGOV-371

CODAGT-607

[ethanndickson]

Merge activity

• Jul 1, 5:55 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 1, 6:01 AM UTC: Graphite couldn't merge this PR because it had merge conflicts.
• Jul 1, 6:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 1, 6:17 AM UTC: @ethanndickson merged this pull request with Graphite.