fix(bootstrap): mise //cdk:bootstrap silently no-ops on an already-bootstrapped account

### Observed (live, us-east-1, 2026-07-31)

On an account with a pre-existing default `CDKToolkit` stack, `mise //cdk:bootstrap` (and the underlying `npx cdk bootstrap --template bootstrap/bootstrap-template.yaml`) **exits 0 without applying the ABCA template**: `BootstrapVariant` stays `AWS CDK: Default Resources`, the CloudFormation execution role keeps `AdministratorAccess`, and the five ABCA scoped policies are never attached. Because the command reports success, the operator has no signal, and the condition recurs on every retry.

Workaround that succeeded during the ADR-021 P1 verification run: pass `--force`.

### Proposal

- Add `--force` to the bootstrap task (or detect the variant mismatch and fail loudly with the `--force` remedy)
- Document the already-bootstrapped-account case in DEPLOYMENT_ROLES.md alongside the existing `ComputeTypes` parameter guidance

Found during the ADR-021 P1 live verification (evidence in the #645 verification findings). Refs #645.

Inizia dall'attività mise //cdk:bootstrap ed esamina bootstrap/bootstrap-template.yaml, quindi leggi DEPLOYMENT_ROLES.md per consultare le indicazioni esistenti su ComputeTypes. Riproduci il caso con un account CDKToolkit di cui sia già stato eseguito il bootstrap e verifica che il template ABCA venga applicato con --force, oppure che una mancata corrispondenza della variante fallisca con una soluzione chiara; documenta il caso in DEPLOYMENT_ROLES.md.

Scritto dal modello di indicizzazione a partire dal testo della issue.