fix: drop empty Bedrock token and runtime-host base URL from CLI env

[WeAreResilience]

Summary

Fixes #1896. With use_bedrock: "true" and an application inference profile ARN as the model, Claude Code could not resolve the profile's backing model because of two values the run step passes to the CLI:

• ANTHROPIC_BEDROCK_BASE_URL defaulted to https://bedrock-runtime.<region>.amazonaws.com. Claude Code (2.1.299, the pinned version) builds its control-plane BedrockClient with endpoint: ANTHROPIC_BEDROCK_BASE_URL when the variable is set, so GetInferenceProfile went to bedrock-runtime. Unset, that client uses bedrock.<region>.amazonaws.com, and the runtime client already defaults to the bedrock-runtime host.
• AWS_BEARER_TOKEN_BEDROCK was exported as "" when the workflow did not set it. The AWS SDK's auth scheme selector picks httpBearerAuth whenever AWS_BEARER_TOKEN_<signing name> exists in the environment, so the OIDC SigV4 credentials were not used and the lookup failed with "request could not be signed with token since the token is not defined".

Both action.yml files now pass ANTHROPIC_BEDROCK_BASE_URL through unchanged, and parseSdkOptions drops either variable from the CLI env when it is empty or whitespace. A workflow that sets either value keeps it as before. The base-action README note on the endpoint is updated to match.

Not tested against a real Bedrock account. I reproduced the signing error with the bundled 2.1.299 CLI, fake SigV4 credentials, AWS_BEARER_TOKEN_BEDROCK= and an inference profile ARN, and read the endpoint and auth selection in that binary.

Test plan

• bun test in the repo root and in base-action/ (no new failures; the root's 27 git-based failures are the same set on unmodified main in my environment)
• bun run typecheck (root and base-action/) and bun run format:check
• New parseSdkOptions tests: each variable is dropped when empty or whitespace, kept when set, and not added when unset; the drop cases fail without the change
• New metadata tests for both action.yml files assert ANTHROPIC_BEDROCK_BASE_URL maps straight from env; they fail on main