feat: add Bedrock Runtime endpoint support (SDK-290) (#3623)

## Summary

Add first-class Amazon Bedrock Runtime support to the Python SDK while
preserving the existing Mantle endpoint and legacy clients.

- Add `bedrock(endpoint="runtime" | "mantle")`; Mantle remains the
default.
- Select Runtime hostnames and SigV4 signing atomically:
`bedrock-runtime.<region>.<partition>/openai/v1` signs with `bedrock`;
Mantle continues to sign with `bedrock-mantle`.
- Infer canonical endpoint families from explicit/environment base URLs
and recognize FIPS, dual-stack, trailing-dot, China, European sovereign,
ISO, ISOB, ISOE, and ISOF endpoints.
- Reject invalid/injected regions, canonical HTTP, family/region
mismatches, cross-origin requests, and ambiguous custom-host SigV4
configuration.
- Preserve bearer keys, environment bearer precedence, refreshable
sync/async token providers, named AWS profiles, default chains,
static/session credentials, retry re-signing, and legacy custom-host
compatibility.
- Document Runtime installation, API versions/routes, Chat Completions,
streaming, async use, bearer/SigV4 authentication, profiles, inference
profiles, and deployment limitations in `bedrock.md` and
`examples/bedrock_runtime.py`.
- Extend the explicitly opt-in live harness across
`us.openai.gpt-5.6-{sol,terra,luna}`,
bearer/provider/profile/static/default-chain authentication, streaming,
and Runtime Responses.
- Extend packaged-wheel CI smoke coverage to verify both endpoint
families, both auth modes, correct signing services, and botocore-free
bearer authentication.

### Example

```python
from openai import OpenAI
from openai.providers import bedrock

client = OpenAI(
    provider=bedrock(endpoint="runtime", region="us-west-2", api_key=None)
)

completion = client.chat.completions.create(
    model="us.openai.gpt-5.6-sol",
    messages=[{"role": "user", "content": "Say hello!"}],
    stream=True,
)
for chunk in completion:
    print(chunk.choices[0].delta.content or "", end="")
```

## Verification

- `pytest -q -n 0 tests/lib/test_bedrock_runtime.py
tests/lib/test_bedrock_provider.py
tests/lib/test_bedrock_auth_conformance.py
tests/lib/test_bedrock_credential_chain.py tests/lib/test_bedrock.py` —
**197 passed**, including **56 new Runtime cases**.
- `pytest -q -n auto tests/lib tests/test_httpx2.py` — **330 passed**.
- `ruff check .` and Ruff format checks for every changed file — passed.
- Strict Pyright across all changed Python files — **0 errors**.
- mypy across changed production, example, and wheel-validator files —
passed.
- `uv build --python .venv/bin/python` — wheel and source distribution
built successfully.
- `python scripts/utils/validate-bedrock-wheel.py` — packaged
Mantle/Runtime bearer/SigV4 smoke checks passed.
- `python scripts/utils/validate-python-version-wheel.py` — wheel/source
Python metadata validated.

Live AWS requests were not executed because AWS credentials are
unavailable in this workspace; the guarded harness is ready for an
authorized Bedrock account.

## References

- [SDK-290: Add Bedrock Runtime support across OpenAI
SDKs](https://linear.app/openai/issue/SDK-290/add-bedrock-runtime-support-across-openai-sdks)
- [Reference Node implementation:
openai/openai-node#2348](https://github.com/openai/openai-node/pull/2348)