Bedrock Mantle needs its own IAM prefix, not bedrock:InvokeModel

Writing a least-privilege policy for a client to call Claude on Bedrock through the SDKs Mantle client, granting bedrock:InvokeModel is not enough and the failures arrive one 403 at a time. Mantle is a separate IAM service prefix: the first call needs bedrock-mantle:CreateInference on the project resource, and once that is granted a bearer-token caller then needs bedrock-mantle:CallWithBearerToken. Neither is implied by the classic bedrock actions, and the error text names the missing action precisely, so iterating on 403s is a workable if tedious discovery method. Keep the legacy bedrock:InvokeModel statement too if anything might use the non-Mantle client, and scope it to the anthropic foundation-model and inference-profile ARNs. Also worth knowing when verifying such a key: a tiny max_tokens can be consumed entirely by a thinking block, so the response comes back with no text and reads like a broken credential when the call actually succeeded -- check usage counters and stop_reason before concluding anything.