refactor: add aws-sdk auth mode and tighten provider auth

src/agents/models.profiles.live.test.ts

@@ -11,7 +11,7 @@ import {
   isAnthropicRateLimitError,
 } from "./live-auth-keys.js";
 import { isModernModelRef } from "./live-model-filter.js";
-import { getApiKeyForModel } from "./model-auth.js";
+import { getApiKeyForModel, requireApiKey } from "./model-auth.js";
 import { ensureClawdbotModelsJson } from "./models-config.js";
 import { isRateLimitErrorMessage } from "./pi-embedded-helpers/errors.js";
 
@@ -226,7 +226,7 @@ describeLive("live models (profile keys)", () => {
           const apiKey =
             model.provider === "anthropic" && anthropicKeys.length > 0
               ? anthropicKeys[attempt]
-              : apiKeyInfo.apiKey;
+              : requireApiKey(apiKeyInfo, model.provider);
           try {
             // Special regression: OpenAI requires replayed `reasoning` items for tool-only turns.
             if (