Bedrock rerank 403 — completeAgentRuntimeRequest signing with wrong SigV4 service name

[msuntharesan]

We're currently evaluating Bifrost as a replacement for our LiteLLM setup, and have been very impressed so far. One blocker we've hit involves the Bedrock rerank endpoint.

When calling POST /v1/rerank with a Bedrock model, we consistently get:

403: Credential should be scoped to correct service: 'bedrock'

After digging in, the root cause appears to be that completeAgentRuntimeRequest (introduced in #1694) signs requests with "bedrock-agent-runtime" as the SigV4 service name, whereas AWS requires "bedrock" for all Bedrock endpoints — including agent runtime. completeRequest already uses "bedrock" correctly.

The IAM permission (bedrock:Rerank) is in place and correct — this is purely a signing issue.