fix: honor configured STS endpoint for "ambient" credentials

Ambient credential resolution built a bare STS client, so a web-identity
token found by the SDK default chain (e.g. AWS_WEB_IDENTITY_TOKEN_FILE on
a self-hosted runner) was exchanged with public STS instead of any
operator-configured sts-endpoint. Resolution now passes the configured
region, endpoint, and proxy handler to the default provider chain.

test/CredentialsClient.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('@aws-sdk/credential-provider-node', () => ({
+  defaultProvider: vi.fn(() => async () => ({ accessKeyId: 'AKIA', secretAccessKey: 'secret' })),
+}));
+
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { CredentialsClient } from '../src/CredentialsClient';
+
+describe('CredentialsClient', {}, () => {
+  it('pins ambient credential resolution to the configured region and STS endpoint', {}, async () => {
+    const client = new CredentialsClient({
+      region: 'eu-west-1',
+      stsEndpoint: 'https://sts.example.com',
+      roleChaining: false,
+    });
+    // biome-ignore lint/suspicious/noExplicitAny: any required to call private method
+    await (client as any).loadCredentials();
+    expect(defaultProvider).toHaveBeenCalledWith({
+      clientConfig: expect.objectContaining({ region: 'eu-west-1', endpoint: 'https://sts.example.com' }),
+    });
+  });
+
+  it('omits unset client config values from ambient credential resolution', {}, async () => {
+    const client = new CredentialsClient({ region: 'eu-west-1', roleChaining: false });
+    // biome-ignore lint/suspicious/noExplicitAny: any required to call private method
+    await (client as any).loadCredentials();
+    expect(defaultProvider).toHaveBeenLastCalledWith({ clientConfig: { region: 'eu-west-1' } });
+  });
+});