feat(orchestration): scope workflow model admission to the deployed geography

### Component

CDK / infrastructure (`cdk/src/handlers/shared/workflows.ts`)

### Describe the feature

Scope `WORKFLOW_MODEL_ALLOWLIST` to the geography the deployment actually grants, instead of admitting all seven.

```ts
// cdk/src/handlers/shared/workflows.ts
export const WORKFLOW_MODEL_ALLOWLIST: readonly string[] = DEFAULT_BEDROCK_MODEL_IDS.flatMap(
(bare) => [bare, ...BEDROCK_GEO_REGIONS.map((geo) => `${geo}.${bare}`)],
);
```

Every geography is admitted regardless of which one the stack was deployed with, so a workflow pinning `eu.anthropic.claude-opus-5` on a `global` deployment passes admission and then fails at turn 0 with `AccessDenied` — the IAM grant is scoped to one geography's profile ARNs, resolved at synth.

### Use case

This is the same failure class the surrounding work exists to eliminate: a model that cannot work is accepted silently and surfaces as an unattributed turn-0 failure rather than a rejection at submit time. `repo onboard --model` already rejects a wrong-geography value by reading the stack's `BedrockGeoRegion` output; workflow admission does not.

### Proposed solution

The allowlist is a module-level constant in a runtime handler, so the deployed geography is not available where it is currently built. Two shapes:

1. Deliver the resolved geography to the admission handler as an environment variable (the stack already injects `ANTHROPIC_MODEL` and `ANTHROPIC_DEFAULT_HAIKU_MODEL` the same way) and narrow the list at module load.
2. Fold it into the context-sourced list the file's own comment anticipates ("A future Phase 4 will source this from the repo Blueprint"), which would carry the geography with it.

Not urgent: no shipped workflow pins a model today, so the list is currently unreachable in practice — `disallowedWorkflowModel` returns `null` for every shipped descriptor. It becomes reachable the moment one does.

### Other information

Raised during review of #806 and deliberately kept out of it — that PR closes the CLI-side and doctor-side instances of this class, and widening it into the runtime admission path needs the geography plumbing above rather than a one-line change.

Start in cdk/src/handlers/shared/workflows.ts with WORKFLOW_MODEL_ALLOWLIST and disallowedWorkflowModel, then inspect how the stack injects ANTHROPIC_MODEL and ANTHROPIC_DEFAULT_HAIKU_MODEL. Trace the deployed geography plumbing and choose how admission receives it; done means a workflow using a model from another geography is rejected before execution while valid models remain admitted.

Written by the indexing model from the issue text.