feat(cdk): switch Bedrock inference profile to the global geo

Child 6 of 6 — parent #741. **Behavior change. Depends on #746 being deployed first.**

Flips the geo from `us` to `global`. One context value + three default strings; revert is a one-line context change.

## Blocked by

- **#746** — the `bedrockGeoRegion` plumbing must be deployed first, or the IAM grant won't cover `inference-profile/global.anthropic.…` and every task fails at turn 0 with `AccessDenied`.
- **#745** recommended first, so Opus 5 is already proven in production on the `us.` profile and this change isolates the geo variable.

## Verified prerequisites (us-east-1, acct 677276119483)

| Profile | Status | `InvokeModel` |
|---|---|---|
| `global.anthropic.claude-opus-5` | ACTIVE | ✅ 200 |
| `global.anthropic.claude-haiku-4-5-20251001-v1:0` | ACTIVE | ✅ 200 |

SDK path verified end-to-end with the pinned toolchain (`claude-agent-sdk==0.2.110`, bundled CLI `2.1.191`): `agent/scripts/diagnostics/test_sdk_smoke.py` with `ANTHROPIC_MODEL=global.anthropic.claude-opus-5` **and** `ANTHROPIC_DEFAULT_HAIKU_MODEL=global.anthropic.claude-haiku-4-5-20251001-v1:0` returned `status=success turns=1` in 3.6s. No SDK/CLI bump required.

## Why global

`global.` routes to any supported commercial AWS Region, giving higher throughput and better resilience under peak demand than a US-only profile. That matters for a workload whose tasks run up to 8h and burst.

**The tradeoff is data residency.** A deployer with a residency requirement must keep a geo profile (`us.`/`eu.`/`apac.`) instead — which is why #746 made this a context key rather than a second hardcode. Document the tradeoff in the canonical section from #742: when to prefer `global.` (throughput/resilience) vs a geo profile (residency), and that the geo choice must match the deployment Region's entitlements.

There is prior art in-repo: `.threat-composer/20260526-1924/config/config.json` pins `global.anthropic.claude-opus-4-6-v1`.

## Scope

| File | Change |
|---|---|
| `cdk/cdk.json` | add `context: { "bedrockGeoRegion": "global" }` — the file currently has **no** `context` block |
| `agent/src/config.py:563` | `ANTHROPIC_MODEL` fallback → `global.anthropic.claude-opus-5` |
| `agent/src/models.py:157` | `anthropic_model` default → same |
| `cli/src/repo-display.ts:48` | `PLATFORM_REPO_DEFAULTS.model_id` → same |
| `cdk/src/handlers/shared/workflows.ts:84` | add `global.anthropic.claude-opus-5` to `WORKFLOW_MODEL_ALLOWLIST` (#744 deliberately held this back) |
| docs | geo tradeoff subsection + documented default (#742 drift test will enforce) |

`ANTHROPIC_DEFAULT_HAIKU_MODEL` needs no edit — #746 derives its prefix from the context key.

The generalized drift guard from #746 accepts the `global.` prefix; if it fails here, #746 is incomplete and this issue is blocked rather than the guard being wrong.

## Rollback

Set `bedrockGeoRegion` back to `us` in `cdk.json` and redeploy; revert the three default strings. Because #746 keeps both geos' plumbing valid, rollback needs no code restructuring. The `us.` profile ARNs remain granted only if `bedrockGeoRegion` is `us` — so **roll back context and defaults together**, not independently.

## Acceptance criteria

- [ ] #746 confirmed deployed before merge
- [ ] `cdk.json` sets `bedrockGeoRegion: "global"`
- [ ] Three default strings updated to `global.anthropic.claude-opus-5` in one commit
- [ ] `global.anthropic.claude-opus-5` added to `WORKFLOW_MODEL_ALLOWLIST`
- [ ] `cdk diff` reviewed: inference-profile ARNs change `us.` → `global.`; foundation-model ARNs unchanged (already `region: '*'`)
- [ ] Deployed smoke test on **`agentcore`**: one task completes end-to-end and opens a PR
- [ ] ECS / `lambda-microvm` verification is **out of scope** — CI deploys `agentcore` only (`ALLOWED_COMPUTE_TYPES: "agentcore"` in `.github/workflows/build.yml` + `deploy.yml`). ECS unit-test coverage still applies and must pass
- [ ] `platform doctor` passes its access probe against the global profile
- [ ] Docs updated with the global-vs-geo tradeoff and residency caveat; `mise //docs:sync` run
- [ ] Rollback rehearsed: `-c bedrockGeoRegion=us` synths cleanly with `us.` ARNs
- [ ] `mise run build` green

## Notes

Blocked by #746. Final step in the #740/#741 stack.