fix(bedrock): honor cancellation during bearer credential resolution (#2478)

## Summary

- Honor the documented per-request `signal` while a Bedrock bearer
`tokenProvider` is resolving, including dependency-free and AWS bearer
provider entrypoints.
- Preserve configured-origin and Authorization ownership validation,
direct user-abort causes, existing credential-provider error wrapping,
credential rotation, static and environment credentials, and hostile
AbortSignal cleanup behavior.
- Prevent cancelled credential resolution from attaching authorization
headers or reaching fetch, without introducing provider timeouts or
unsupported signal options.

## Validation

- Reproduced through real `new OpenAI({ provider: bedrock({
tokenProvider }), fetch }).models.list({ signal })` requests across both
provider entrypoints and Mantle/runtime endpoints, including retries,
reentrant registration, throwing cleanup/getters, native Promise
compatibility, NaN first-cause ownership, and late provider failures.
- 6,325 handwritten tests; 556 isolated generated tests; 227 adjacent
Bedrock tests on both Node 22 and Node 24.
- Full formatting/lint, strict source types, rebuilt package, published
TypeScript 4.9 and current types, publint, packed package, and real
built CommonJS/ESM cancellation smoke tests.