refactor(bedrock): make resolve_bedrock_runtime_region the single region chokepoint

Follow-up structural pass on the review fix:

- Runtime provider, auxiliary resolution, model validation
  (hermes_cli/models.py), live discovery (bedrock_model_ids_or_none),
  and the Mantle URL/SigV4 fallbacks all resolve their region through
  resolve_bedrock_runtime_region() — one canonical implementation of the
  config-first priority instead of three hand-rolled copies.
- agent_init: drop the 'if "client_kwargs" in locals()' guard by
  initializing client_kwargs unconditionally at the top of the else
  branch; the Mantle kwargs hook is a documented no-op for non-Mantle
  base URLs.

hermes_cli/runtime_provider.py

@@ -2235,7 +2235,7 @@ def resolve_runtime_provider(
         from agent.bedrock_adapter import (
             has_aws_credentials,
             resolve_aws_auth_env_var,
-            resolve_bedrock_region,
+            resolve_bedrock_runtime_region,
             is_anthropic_bedrock_model,
             is_openai_bedrock_model,
             bedrock_openai_base_url,
@@ -2258,9 +2258,9 @@ def resolve_runtime_provider(
         # Read bedrock-specific config from config.yaml
         _bedrock_cfg = load_config().get("bedrock", {})
         # Region priority: config.yaml bedrock.region → env var → us-east-1.
-        # Same resolution as resolve_bedrock_runtime_region() in
-        # agent/bedrock_adapter.py — auxiliary calls must agree with this.
-        region = (_bedrock_cfg.get("region") or "").strip() or resolve_bedrock_region()
+        # resolve_bedrock_runtime_region() is the canonical implementation of
+        # this priority; auxiliary resolution uses the same helper.
+        region = resolve_bedrock_runtime_region({"bedrock": _bedrock_cfg})
         auth_source = resolve_aws_auth_env_var() or "aws-sdk-default-chain"
         # Build guardrail config if configured
         _gr = _bedrock_cfg.get("guardrail", {})