Amazon Bedrock Converse API adapter. Pure translation, no I/O; the SigV4
signing that authenticates the dial is a separate axis
([crate::auth::aws], applied by the transport in super::endpoints).
Optional, capability-negotiated model discovery: agentd learns what an
endpoint serves via a tiny handshake. The rules that keep it harmless are
absolute — it runs only when an endpoint looks discovery-capable, stays
silent on failure, is never fatal, never sits on the hot path, and never
runs at startup ahead of a side effect.