fix(bootstrap): mise //cdk:bootstrap silently no-ops on an already-bootstrapped account

### Observed (live, us-east-1, 2026-07-31)

On an account with a pre-existing default `CDKToolkit` stack, `mise //cdk:bootstrap` (and the underlying `npx cdk bootstrap --template bootstrap/bootstrap-template.yaml`) **exits 0 without applying the ABCA template**: `BootstrapVariant` stays `AWS CDK: Default Resources`, the CloudFormation execution role keeps `AdministratorAccess`, and the five ABCA scoped policies are never attached. Because the command reports success, the operator has no signal, and the condition recurs on every retry.

Workaround that succeeded during the ADR-021 P1 verification run: pass `--force`.

### Proposal

- Add `--force` to the bootstrap task (or detect the variant mismatch and fail loudly with the `--force` remedy)
- Document the already-bootstrapped-account case in DEPLOYMENT_ROLES.md alongside the existing `ComputeTypes` parameter guidance

Found during the ADR-021 P1 live verification (evidence in the #645 verification findings). Refs #645.

Start at the mise //cdk:bootstrap task and review bootstrap/bootstrap-template.yaml, then read DEPLOYMENT_ROLES.md for the existing ComputeTypes guidance. Reproduce with an already-bootstrapped CDKToolkit account and verify that the ABCA template is applied with --force, or that a variant mismatch fails with a clear remedy; document the case in DEPLOYMENT_ROLES.md.

Written by the indexing model from the issue text.