fix(engine-claude-agent-sdk): export inheritEssentialHostEnv + restore Bedrock/AWS allow-list

Two regressions caught by running the full workspace test suite (`pnpm
-r test`):

  1. `inheritEssentialHostEnv` was declared but not exported. The test
     in src/engine.test.ts imports it as a named export, so the suite
     threw 'inheritEssentialHostEnv is not a function' at three tests.
     Added 'export' to the declaration at line 272.

  2. The function's allow-list had been trimmed back to just POSIX/XDG
     basics (HOME, PATH, USER, …). This regressed task #68 (Phase 2a:
     OSS PR — Bedrock env passthrough), which is the contract that lets
     a worker pod with IRSA-injected AWS_ROLE_ARN +
     AWS_WEB_IDENTITY_TOKEN_FILE actually invoke Bedrock. Restored the
     9 keys the test (and reality) require:
       CLAUDE_CODE_USE_BEDROCK
       AWS_REGION
       AWS_DEFAULT_REGION
       AWS_BEDROCK_MODEL_ID
       AWS_ROLE_ARN
       AWS_WEB_IDENTITY_TOKEN_FILE
       AWS_PROFILE
       AWS_SHARED_CREDENTIALS_FILE
       AWS_CONFIG_FILE

After the fix: 10/10 engine-claude-agent-sdk tests pass (was 7/10).
Full workspace suite: 422 passing, 40 skipped (offline, gated on env),
0 failures across all 22 packages with tests.

How the regression got in: PR #10 (policy guardrails) was authored on
a branch that started before the Bedrock-env work in task #68 landed;
when it merged to main + I --theirs-resolved engine.ts during the
chore/oss-cleanup-public merge, the older smaller allow-list won.

Author: shreyas-lyzr

packages/engine-claude-agent-sdk/src/engine.ts

@@ -269,9 +269,11 @@ function signalToController(signal: AbortSignal): AbortController {
  *
  * Caller envs (api keys, etc.) override these on conflict.
  */
-function inheritEssentialHostEnv(): Record<string, string> {
+export function inheritEssentialHostEnv(): Record<string, string> {
   const out: Record<string, string> = {};
   for (const k of [
+    // POSIX + XDG basics — required for the SDK to resolve $HOME, $PATH, etc.
+    // Without these, transcript-mirror writes silently drop.
     "HOME",
     "PATH",
     "USER",
@@ -281,6 +283,19 @@ function inheritEssentialHostEnv(): Record<string, string> {
     "CLAUDE_CONFIG_DIR",
     "XDG_CONFIG_HOME",
     "XDG_DATA_HOME",
+    // Bedrock + AWS IRSA passthrough (task #68 Phase 2a) — when the caller
+    // routes the agent via Bedrock, the AWS SDK's default credential chain
+    // needs these. Picked up automatically from the pod env (IRSA injects
+    // AWS_ROLE_ARN + AWS_WEB_IDENTITY_TOKEN_FILE) or developer shell.
+    "CLAUDE_CODE_USE_BEDROCK",
+    "AWS_REGION",
+    "AWS_DEFAULT_REGION",
+    "AWS_BEDROCK_MODEL_ID",
+    "AWS_ROLE_ARN",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AWS_PROFILE",
+    "AWS_SHARED_CREDENTIALS_FILE",
+    "AWS_CONFIG_FILE",
   ]) {
     const v = process.env[k];
     if (v) out[k] = v;