refactor: add aws-sdk auth mode and tighten provider auth

src/agents/pi-embedded-runner/compact.ts

@@ -115,7 +115,13 @@ export async function compactEmbeddedPiSession(params: {
           agentDir,
         });
 
-        if (model.provider === "github-copilot") {
+        if (!apiKeyInfo.apiKey) {
+          if (apiKeyInfo.mode !== "aws-sdk") {
+            throw new Error(
+              `No API key resolved for provider "${model.provider}" (auth mode: ${apiKeyInfo.mode}).`,
+            );
+          }
+        } else if (model.provider === "github-copilot") {
           const { resolveCopilotApiToken } =
             await import("../../providers/github-copilot-token.js");
           const copilotToken = await resolveCopilotApiToken({