Treat empty AWS environment values as unset

[sylvesterkaczmarek]

Summary

Treat empty AWS-related environment variables as absent in the AWS client credential resolver.

The shared _read_env() helper currently returns the first value that is not None. That means an exported-but-empty variable is considered configured. This is common in CI and container manifests where optional secrets are declared with empty defaults.

The most significant case is ANTHROPIC_AWS_API_KEY="": its mere presence switches auth selection from the default AWS SigV4 credential chain into API-key mode, after which the resolved API key is the empty string. A harmless empty placeholder can therefore disable otherwise valid IAM/role credentials.

The same helper is also used for workspace IDs and AWS base URLs, so an empty higher-priority variable can mask a later usable fallback.

Fix

Have _read_env() return the first non-empty environment value instead of the first non-None value.

Explicit constructor arguments are unchanged. The normalization applies only to environment fallback resolution, matching the SDK's existing treatment of optional environment credentials in other auth paths.

This restores expected fallback behavior:

• an empty AWS API-key env var no longer disables SigV4;
• an empty workspace env var resolves as absent;
• an empty base-URL env var falls through to the region-derived endpoint;
• when multiple env names are supplied, an empty earlier value no longer masks a later configured value.

Regression coverage

Adds focused tests for all four cases above using isolated test environment-variable names.

The production change is confined to the hand-maintained AWS credential-resolution helper.