docs(model): document bedrockGeoRegion and the global-vs-geo tradeoff - #799

Addresses all six review findings on the geo switch. The first was a real defect,
not a documentation error.

FINDING 1 — the one-line rollback was false. `synth -c bedrockGeoRegion=us` granted
`us.` profiles while the agent still asked for `global.anthropic.claude-opus-5`,
because the stack injected only the AUXILIARY model into the runtime env and never
the main one. The main model came from a Python literal that a geography change does
not touch, so every task with no per-repo override would fail at turn 0 with
AccessDenied. My own PR body half-knew this — the prose said "roll back context and
defaults together" while the summary claimed one line.

Fixed by removing the divergence rather than re-syncing literals: both models are
now injected from the resolved geography, via one shared helper, on BOTH substrates
(the ECS task definitions set neither var either, so an ECS task had the same
mismatch). Verified by synthesizing both geographies: grants, AgentCore env and ECS
env now agree in each, so the rollback genuinely is one context value.

Also fixes the fifth stale default the review found, TaskConfig.haiku_model, which I
had missed entirely while counting four.

FINDING 2 — the generalized allow-list invariant was too weak in both directions. It
only proved entries were paired WITHIN the list, which is satisfiable while wrong:
three granted models had no `global.` form (a workflow pinning one was rejected at
admission), and the reviewer's invented pair passed all 22 tests despite being
granted nothing. Replaced with parity against DEFAULT_BEDROCK_MODEL_IDS across the
deployable geographies, in both directions, and confirmed the reviewer's exact
mutation now fails.

FINDING 3 — the `--model` guard let through a well-formed but ungranted model. My
justification for that was wrong: I claimed the CLI cannot read `bedrockModels`, but
`get-template` recovers the granted set from the profile ARNs using credentials the
CLI already needs. Added a `BedrockModelIds` output — a documented contract rather
than a regex over CloudFormation — and the guard now rejects an ungranted model,
listing what the stack does grant. Also fixes the reverse-compatibility bug: with no
geography exported, the bare-id error no longer prescribes `us.`, which a
default-global stack does not grant.

FINDING 4 — doctor's profile check is relabelled "visible" and its detail states that
resolution happens under operator credentials and does not prove the workload role
can invoke. The narrow wording was already accurate, but a PASS feeding "All checks
passed" still read as readiness.

FINDINGS 5-6 — carries #799's documentation so this branch is not self-contradictory,
corrects the onboarding and troubleshooting skills that recommended `us.` overrides
this branch would now reject (and still called Sonnet 4.6 the default), and fixes the
stale "default us" wording in the new output description.

One test rewritten rather than re-pinned: the agent's haiku-default test asserted
`startswith("us.")` when its stated intent was "must be a profile, not a bare id". It
now asserts a geo prefix, so it tests the property instead of a geography that is a
deploy-time choice.