[johnnyhuy]

The CLI probe layer now mirrors the app for the cloud providers, so hoist keys probe works for Bedrock, Vertex and Azure OpenAI instead of falling through to no probe implemented. Bedrock probes through the AWS environment chain without a vault key, Vertex reads its stored project and region sibling entries, and Azure resolves its endpoint from AZURE_OPENAI_ENDPOINT.

Closes #51
Refs #15

Verification

• mise run ci:cli passed in this worktree (bun install, typecheck, the new bun test suite, and the compiled CLI build).
• mise run ci:app passed (catalog check, typecheck, lint, unit tests and the full build). App source is untouched in this PR; it was run because the CI script change sits in the shared scripts folder.
• The new tests first failed against the pre-change code with Export named 'probeBedrock' not found, then passed after the implementation.

Proof is from mocked HTTP only, with no live provider keys. The fixture server in the tests records the signed Bedrock request, the Vertex project and region path, and the Azure api-key header.

bun test v1.3.14 (0d9b296a)

test/probes-cloud.test.ts:
(pass) vault sibling config secret ids match the app convention
(pass) aws no credentials returns invalid with AWS error
(pass) aws mocked 200 returns ok and sends a SigV4 signed request
(pass) aws mocked 403 surfaces the AWS error code
(pass) aws SigV4 signature is deterministic for a fixed clock
(pass) gcp missing project and region returns error without HTTP
(pass) gcp mocked 200 returns ok with project and region in the path
(pass) azure missing endpoint returns error, mocked 200 validates
(pass) probeProvider dispatches cloud kinds instead of No probe implemented

 9 pass
 0 fail

Built CLI transcript, with the AWS environment cleared and no vault key stored:

$ bun run src/index.ts keys probe bedrock
✗ invalid · AWS error: NoCredentialProviders: no AWS credentials found. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or configure the standard AWS credential chain
exit:1

$ bun run src/index.ts keys probe azure-openai
No key stored for azure-openai. Run `hoist keys set azure-openai` first.
exit:1

The Bedrock line is the point of the wiring change. The probe now reaches the aws probe and reports the missing credential chain, instead of stopping at the vault key check.

Reviewer notes

• No live Bedrock or Vertex call was made. Confirming a Bedrock probe against a real AWS account still needs working AWS credentials with Bedrock access, and confirming Vertex still needs a real access token, project id and region.
• Probe wording and result shapes copy src/main/probes/ exactly, so the app and CLI report the same detail strings for the same failure.
• The parent issue Probe Bedrock and Vertex provider keys (ADR-0003 follow-up) #15 stays open. Its remaining acceptance items need live provider accounts, and OpenCode native plugin for auto-discovery of installed harnesses #17 is untouched.
• scripts/ci/cli.sh now runs bun test between typecheck and the compiled build, so the new suite gates the CLI release flow.