Clarify unsupported model-provider credentials

[Rachael-Graham]

The 1.x provider docs describe credential shapes that the compiler rejects. kagent-dev/kagent#2868 moved model credentials onto Agent Substrate's egress gateway, which injects a static string into an HTTP header, and four documented configurations cannot take that form. The pages were never revisited.

Verified on a cluster

A kind cluster built from 1e5533b2 (v1.0.0-alpha2 plus five commits), each case applied as a ModelConfig and an AgentTemplate. Every rejection reports Compatible=False with the reason UnsupportedConfiguration.

Case	Result
OpenAI on kagent	Ready — control
Bedrock bearer token on kagent	Ready — control
Anthropic on claude	Ready — control
Bedrock with IAM access keys	environment credential "AWS_ACCESS_KEY_ID" cannot use gateway header injection
SAPAICore	the same error, on SAP_AI_CORE_CLIENT_ID
AnthropicVertexAI on claude	the same error, on KAGENT_CLAUDE_GOOGLE_CREDENTIALS_JSON
Harness spec.env credentialRef	arbitrary credentialRef values cannot be injected into HTTP headers

The three controls reach a ready golden snapshot, so injection works and the claude harness is healthy — the rejections are about the credentials.

The credentialRef case is the worst of them. It is the main example on the Harness page, the CRD accepts the field, and the Harness applies cleanly, so the reader gets a clean kubectl apply and an agent that never runs.

Changes

• about-model-providers.md — replaces the "credential files" model with header injection: the per-provider header table, the hostname matching rules, and a Credentials that do not compile section giving each rejected configuration and its alternative. The three file-mount cases stay, as rows rather than as the whole story.
• agent-harness.md — drops credentialRef from the main example and the field table, flips AnthropicVertexAI and SAPAICore to ❌ on all four runtimes, and replaces the stale Vertex restriction row with the Bedrock bearer-token rule.
• amazon-bedrock.md — the native procedure creates a bearer-token Secret instead of IAM access keys.
• google-vertexai.md, sap-ai-core.md — cut to a short notice, the verbatim error, and a table routing to a provider that serves the same models. Both URLs stay live.
• anthropic.md, gemini.md — each pointed readers at Vertex AI as a working alternative.

Open question, and why this is a draft

Some of this may be temporary. Vertex AI and SAP AI Core fail for the same underlying reason, a credential that needs a token exchange before the request, and a gateway-side exchange would restore both at once. Bedrock IAM signing and arbitrary credentialRef values look settled: docs/architecture/credential-injection.md lists all four as rejected by design rather than unimplemented.

The pages are written as "on kagent 1.0" and "today" rather than "never", so restoring a provider is a prose edit and not a structural one. The call worth making before this merges is whether to hold it until upstream says which of the four it intends to keep.

🤖 Generated with Claude Code

[github-actions]

Docs preview

Link	Points at
Branch preview	The newest push to this branch. Updates in place.
Commit preview	edcb574 only. Frozen.

Both are uploaded Worker versions and serve no production traffic.

[Rachael-Graham]

Follow-up filed as #530.

Rewriting google-vertexai.md removes the only claude Harness example in the 1.x set, which leaves assets/kagent-docs/versions/runtime-image-claude.md referenced by no page while the nightly job keeps resolving it. #530 covers restoring a Claude example, adding the Codex one the set has never had, and wiring the missing runtime-image-codex conref into update-ref-docs.yaml.

Not a blocker for this PR — the pages it touches are correct as they stand — but the two should land close together.