fix(bootstrap): mise //cdk:bootstrap silently no-ops on an already-bootstrapped account

### Observed (live, us-east-1, 2026-07-31)

On an account with a pre-existing default `CDKToolkit` stack, `mise //cdk:bootstrap` (and the underlying `npx cdk bootstrap --template bootstrap/bootstrap-template.yaml`) **exits 0 without applying the ABCA template**: `BootstrapVariant` stays `AWS CDK: Default Resources`, the CloudFormation execution role keeps `AdministratorAccess`, and the five ABCA scoped policies are never attached. Because the command reports success, the operator has no signal, and the condition recurs on every retry.

Workaround that succeeded during the ADR-021 P1 verification run: pass `--force`.

### Proposal

- Add `--force` to the bootstrap task (or detect the variant mismatch and fail loudly with the `--force` remedy)
- Document the already-bootstrapped-account case in DEPLOYMENT_ROLES.md alongside the existing `ComputeTypes` parameter guidance

Found during the ADR-021 P1 live verification (evidence in the #645 verification findings). Refs #645.

Comienza con la tarea mise //cdk:bootstrap y revisa bootstrap/bootstrap-template.yaml; después, lee DEPLOYMENT_ROLES.md para consultar las instrucciones existentes sobre ComputeTypes. Reproduce el caso con una cuenta CDKToolkit que ya haya sido bootstrappeada y verifica que la plantilla ABCA se aplique con --force, o que una discrepancia de variante falle con una solución clara; documenta el caso en DEPLOYMENT_ROLES.md.

Escrito por el modelo de indexación a partir del texto del issue.