Allow custom `http_headers` / `env_http_headers` on the built-in `amazon-bedrock` model provider

What variant of Codex are you using?

App

What feature would you like to see?

Summary

config.toml currently has no way to attach custom HTTP headers (e.g. OpenAI-Project) to requests sent through the built-in amazon-bedrock model provider.

Current behavior

merge_configured_model_providers()only allows aws.profile and aws.region to be overridden for the amazon-bedrock provider. Any other non-default field, including http_headers, causes a hard error:

model_providers.amazon-bedrock only supports changing `aws.profile` and `aws.region`; other non-default provider fields are not supported

Setting headers under the aws sub-table instead (ModelProviderAwsAuthInfo) doesn't error, but is silently dropped, since that struct only has profile and region fields.

Why this matters

Some Bedrock setups (e.g. routing through an internal Bedrock proxy/gateway) require a project-identifying header such as OpenAI-Project on every request. Falling back to a fully custom (non-bedrock) model provider is not a good workaround, since it would require reimplementing AWS SigV4 signing / assume-role manually.

Note: runtime plumbing already supports this

The rest of the pipeline already handles arbitrary headers on the bedrock path:

• ModelProviderInfo.http_headers is turned into a HeaderMap by build_header_map() and applied via to_api_provider().
• The Bedrock provider's api_provider() uses this same to_api_provider().
• SigV4 header stripping only removes headers containing _ (e.g. session_id), so hyphenated headers like OpenAI-Project survive and get signed correctly. remove_headers_not_preserved_by_bedrock_mantle

So only the config-time validation blocks this — no changes are needed to request building or signing.

Proposed fix

In merge_configured_model_providers(), extend the amazon-bedrock special case to also accept http_headers and env_http_headers, merging (extending, not replacing) them into the built-in provider's maps so the existing x-amzn-mantle-client-agent header is preserved.

Additional information

_No response_