Bedrock guardrail tracing in the gateway

What

Amazon Bedrock guardrails are filters Bedrock can apply to requests and replies. The gateway, which passes Claude Code's requests on to upstream providers, can now ask Bedrock to report what its guardrails did:

• The gateway config has a new Bedrock boolean, guardrail_trace, which sets guardrailTrace.
• When it is on, Bedrock requests add the header X-Amzn-Bedrock-Trace: ENABLED. The guardrail id and version headers are now merged with it instead of being the only headers.
• Responses that carry amazon-bedrock-trace produce a guardrail.trace event listing the filters that fired, and the trace field is removed from the event.
• The gateway proxy can attach a guardrail trace row (request_id, sub, email, upstream) to responses and streams when the upstream has guardrailTrace set.
• The gateway config also gains a per-upstream groups list, and desktop overlay validation now reports deprecations with their support-end dates.

Why

If you run Bedrock behind the gateway with guardrails, you can now see which filters acted on a request and who sent it, which helps when a guardrail blocks something unexpectedly.