feat(orchestration): scope workflow model admission to the deployed geography

### Component

CDK / infrastructure (`cdk/src/handlers/shared/workflows.ts`)

### Describe the feature

Scope `WORKFLOW_MODEL_ALLOWLIST` to the geography the deployment actually grants, instead of admitting all seven.

```ts
// cdk/src/handlers/shared/workflows.ts
export const WORKFLOW_MODEL_ALLOWLIST: readonly string[] = DEFAULT_BEDROCK_MODEL_IDS.flatMap(
(bare) => [bare, ...BEDROCK_GEO_REGIONS.map((geo) => `${geo}.${bare}`)],
);
```

Every geography is admitted regardless of which one the stack was deployed with, so a workflow pinning `eu.anthropic.claude-opus-5` on a `global` deployment passes admission and then fails at turn 0 with `AccessDenied` — the IAM grant is scoped to one geography's profile ARNs, resolved at synth.

### Use case

This is the same failure class the surrounding work exists to eliminate: a model that cannot work is accepted silently and surfaces as an unattributed turn-0 failure rather than a rejection at submit time. `repo onboard --model` already rejects a wrong-geography value by reading the stack's `BedrockGeoRegion` output; workflow admission does not.

### Proposed solution

The allowlist is a module-level constant in a runtime handler, so the deployed geography is not available where it is currently built. Two shapes:

1. Deliver the resolved geography to the admission handler as an environment variable (the stack already injects `ANTHROPIC_MODEL` and `ANTHROPIC_DEFAULT_HAIKU_MODEL` the same way) and narrow the list at module load.
2. Fold it into the context-sourced list the file's own comment anticipates ("A future Phase 4 will source this from the repo Blueprint"), which would carry the geography with it.

Not urgent: no shipped workflow pins a model today, so the list is currently unreachable in practice — `disallowedWorkflowModel` returns `null` for every shipped descriptor. It becomes reachable the moment one does.

### Other information

Raised during review of #806 and deliberately kept out of it — that PR closes the CLI-side and doctor-side instances of this class, and widening it into the runtime admission path needs the geography plumbing above rather than a one-line change.

Beginne in cdk/src/handlers/shared/workflows.ts mit WORKFLOW_MODEL_ALLOWLIST und disallowedWorkflowModel und untersuche anschließend, wie der Stack ANTHROPIC_MODEL und ANTHROPIC_DEFAULT_HAIKU_MODEL injiziert. Verfolge die Verdrahtung der bereitgestellten Geografie und entscheide, wie die Zulassung sie erhält; abgeschlossen ist die Aufgabe, wenn ein Workflow, der ein Modell aus einer anderen Geografie verwendet, vor der Ausführung abgelehnt wird, während gültige Modelle weiterhin zugelassen werden.

Vom Indexierungsmodell aus dem Issue-Text verfasst.