feat(pepper): route Bedrock calls through tagged inference profiles [DEV-245]

[brodkin]

Summary

Closes DEV-245. Pepper currently runs both review and on-demand flows through the same Bedrock model ID, so Cost Explorer collapses them into one undifferentiated line item — we can't tell which flow drives spend.

This wires Pepper through two AWS Application Inference Profiles, both wrapping the existing us.anthropic.claude-sonnet-4-5-20250929-v1:0 system inference profile, each carrying its own cost-allocation tags:

Profile	ARN	Tags
pepper-pr-review	arn:aws:bedrock:us-west-2:618640261060:application-inference-profile/cz21awrop223	Product=pepper, Mode=review
pepper-on-demand	arn:aws:bedrock:us-west-2:618640261060:application-inference-profile/68jw718dw1jv	Product=pepper, Mode=on-demand

Both profiles already exist in account 618640261060. The GitHubActions-ClaudeCode-Bedrock role's existing BedrockModelAccess policy already grants InvokeModel* on application-inference-profile/* — no IAM change required.

Workflow changes

• New review_model and on_demand_model inputs default to the two profile ARNs.
• Existing model input becomes an empty-default override that wins for both modes (back-compat for any caller currently setting model: — there are none in this repo's example).
• New Resolve model for this run step picks the right ARN per resolved mode.
• claude_args: --model reads from the resolved value.

Follow-up (not in this PR)

• Cost allocation tag activation. AWS only registers tag keys after a billable resource emits them, so aws ce update-cost-allocation-tags-status errored with Tag keys not found. After this lands and the first review runs, activate Product and Mode in Billing → Cost Allocation Tags. Cost Explorer will populate ~24h later.

Test plan

• PR triggers Pepper auto-review against itself; review-mode profile ARN appears in Resolve model for this run step output
• @pepper comment triggers on-demand mode; on-demand profile ARN appears in resolution step output
• After ~24h, Product and Mode tag keys are selectable in Billing → Cost Allocation Tags
• After ~24h post-activation, Cost Explorer grouped by Mode shows two non-zero series for Bedrock spend

[pepper-pr-review]

Verified against DEV-245 — aligned. The workflow now routes review-mode and on-demand-mode Bedrock calls through separate Application Inference Profiles tagged Mode=review and Mode=on-demand, so Cost Explorer can finally tell you which flow is eating the budget. The three-input hierarchy (override wins, else per-mode default) is clearly documented and the resolution step at :348–367 branches exactly right. Test plan is observational (check the resolution logs, wait 24h for billing to populate) — correct shape for a config-wiring change where the proof is in the spend attribution downstream.

Yours,
Pepper

When you're ready for another look, drop a comment with @pepper review.