app-staging-synthesizer: asset roles should not be created when using `CLI_CREDENTIALS`

### Describe the bug

instead, we should be using the `CLI_CREDENTIALS` credentials to access the bootstrap bucket.

there's a bit more nuance to this then simply that, because the `CLI_CREDENTIALS` aren't accessible in the `DefaultStagingStack` when we decide whether or not to create the asset roles.

### Expected Behavior

n/a

### Current Behavior

n/a

### Reproduction Steps

n/a

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

latest

### Framework Version

_No response_

### Node.js Version

Node 18

### OS

Mac

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start by tracing the app-staging-synthesizer flow and the DefaultStagingStack decision about asset roles, then find how CLI_CREDENTIALS are handled. Confirm the intended behavior for bootstrap-bucket access and ensure asset roles are not created when those credentials are used, with tests covering the credential-dependent paths.

Written by the indexing model from the issue text.