Merge origin/master (PR aws#6036) into fix/private-hub-e2e

Upstream aws#6036 independently fixed the model_reference_arn propagation
(Defect A) with the same 6-line fix. Resolution: kept upstream's
propagation block as canonical (removed our duplicate at the earlier
location), kept our hub_content_name lookup fix (Defect B, not covered
upstream), and kept our unit test file as the superset (upstream's 2
tests assert a subset of our TestModelReferenceArnPropagation).

Verified post-merge: 17/17 unit tests pass, single propagation block,
no conflict markers.

Author: Eli Davidson

sagemaker-serve/src/sagemaker/serve/model_builder_servers.py

@@ -995,13 +995,6 @@ def _build_for_jumpstart(self) -> Model:
                 init_kwargs_params["model_id"] = hub_content_name
         init_kwargs = get_init_kwargs(**init_kwargs_params)
 
-        # Propagate the hub model reference ARN so the container definition
-        # includes S3DataSource.HubAccessConfig.HubContentArn. Without this,
-        # CreateModel requires the execution role to have s3:GetObject on the
-        # public JumpStart cache bucket, defeating private hub brokered access.
-        if getattr(init_kwargs, "model_reference_arn", None):
-            self.model_reference_arn = init_kwargs.model_reference_arn
-
         # Configure image URI and environment variables
         self.image_uri = self.image_uri or init_kwargs.image_uri
 
@@ -1015,6 +1008,12 @@ def _build_for_jumpstart(self) -> Model:
         ):
             self._enable_network_isolation = init_kwargs.enable_network_isolation
 
+        # Propagate model_reference_arn from init_kwargs so that
+        # _prepare_container_def_base can attach HubAccessConfig to the
+        # CreateModel request (required for private hub brokered access).
+        if getattr(init_kwargs, "model_reference_arn", None):
+            self.model_reference_arn = init_kwargs.model_reference_arn
+
         # Handle model artifacts for fine-tuned models
         if hasattr(init_kwargs, "model_data") and init_kwargs.model_data:
             if (