feat(cli): read stack outputs in one call and derive repo show's default geography

### Component

Scripts / CLI (`cli/src/stack-outputs.ts`, `cli/src/platform-doctor.ts`, `cli/src/repo-display.ts`)

### Describe the feature

Two related inefficiencies in how the CLI reads stack outputs.

**1. One `DescribeStacks` call per output.** `getStackOutput` issues a fresh `DescribeStacksCommand` each time and caches nothing:

```ts
// cli/src/stack-outputs.ts
const result = await cf.send(new DescribeStacksCommand({ StackName: stackName }));
```

`runPlatformDoctor` now reads nine outputs, so one `bgagent platform doctor` makes nine calls that each return the same full stack description. They run concurrently in a `Promise.all`, so the wall-clock cost is small, but it is nine API calls where one would do — and `DescribeStacks` is a throttled control-plane operation, so it is the kind of thing that degrades on a busy account rather than on a developer laptop.

**2. `repo show` reports a hardcoded default geography.** `PLATFORM_REPO_DEFAULTS.model_id` is a compile-time literal:

```ts
// cli/src/repo-display.ts
model_id: 'global.anthropic.claude-opus-5',
```

The effective default is `.`, so on a deployment using any other geography `repo show` displays a model the stack does not grant for every repo that sets no override. Correct on the shipped default only.

### Use case

The second is the user-visible one: an operator on a non-`global` deployment reads `repo show`, sees `global.anthropic.claude-opus-5`, and has been told the wrong thing about their own stack — the same class of "documented value diverges from deployed value" the geography work otherwise closes. The first is cheap hygiene that gets slightly worse each time a check is added.

### Proposed solution

- Fetch the stack once and read outputs from that result (either a `describeStack`-level helper that returns all outputs, or a short-lived per-invocation cache keyed by region+stack). `getStackOutput` already has a `getStack` internal that would be the natural seam.
- Derive the displayed default from the stack's `BedrockGeoRegion` output when available, and fall back to the literal only when it is absent (the same degradation `repo onboard --model` already uses for older stacks).

### Other information

Both raised during review of #806 and deliberately deferred: the PR's scope is making an unusable model fail early rather than at turn 0, and neither of these changes that behaviour. The `BedrockGeoRegion` / `BedrockModelIds` outputs that #806 adds are what make the second one implementable.

Start with cli/src/stack-outputs.ts and its existing getStack internal, then trace callers in cli/src/platform-doctor.ts and cli/src/repo-display.ts. Verify how BedrockGeoRegion and other stack outputs are exposed, and inspect the existing repo onboard fallback. Done means one stack description serves the platform doctor reads and repo show derives its default geography from the stack, falling back when the output is absent.

Written by the indexing model from the issue text.