aws sso login --use-device-code fails with dual-stack IAM Identity Center unless AWS_USE_DUALSTACK_ENDPOINT=true

### Describe the bug

When an IAM Identity Center instance has been migrated to the new dual-stack endpoints (per the [IPv6 support announcement](https://aws.amazon.com/blogs/security/iam-identity-center-now-supports-ipv6/)), `aws sso login --use-device-code` fails at the IdP → AWS handoff with the generic error:

> **Something doesn't compute**
> We couldn't verify your sign-in credentials. Please try again.

The default PKCE flow (`aws sso login`) succeeds with the same configuration.

Setting `AWS_USE_DUALSTACK_ENDPOINT=true` causes the same device-code login flow to succeed. This is hard to diagnose due to the obscure error.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

`aws sso login --use-device-code` should complete successfully, or at minimum produce a verification URL from the same endpoint family as the configured `sso_start_url`. When `sso_start_url` is a dual-stack URL (`*.portal..app.aws`), the CLI should call the dual-stack `sso-oidc` endpoint (or the service should return a dual-stack `verificationUriComplete`) so that the SAML exchange is initiated from the endpoint family the IdP is configured for.

### Current Behavior

- `aws sso login` (default PKCE flow): **works**. Authorize URL: `https://oidc.us-east-1.amazonaws.com/authorize?...`
- `aws sso login --use-device-code`: browser opens `https://ssoins-.us-east-1.portal.amazonaws.com/#/device?user_code=XXXX-XXXX`, Google sign-in succeeds, then the redirect back to AWS fails with "Something doesn't compute / We couldn't verify your sign-in credentials."
- If the user first establishes an AWS access portal session in the same browser (e.g. by completing a normal portal login), the device-code flow then succeeds — because the SAML exchange is skipped entirely when a session already exists.
- `AWS_USE_DUALSTACK_ENDPOINT=true aws sso login --use-device-code`: **works**.

### Reproduction Steps

Prerequisites:
1. IAM Identity Center instance (primary region `us-east-1`) using Google Workspace as the external SAML IdP.
2. Google Workspace SAML app configured with the **dual-stack** sign-in URL, ACS URL, and issuer URL from Identity Center (Settings → Identity source → Manage authentication). Google Workspace only supports a single ACS URL / Entity ID per SAML app, so the IPv4 URLs are replaced, not supplemented — as AWS's own migration guidance prescribes for single-ACS IdPs.
3. `sso_start_url` in `~/.aws/config` set to the dual-stack portal start URL.

Steps:
1. Ensure no existing AWS access portal session in the browser (use a fresh browser profile, or sign out).
2. Run `aws sso login --use-device-code`.
3. Open the verification URL, enter/confirm the code, and complete Google sign-in.
4. Observe the "Something doesn't compute" error on redirect back to AWS.
5. Re-run with `AWS_USE_DUALSTACK_ENDPOINT=true aws sso login --use-device-code` — login completes successfully.

### Possible Solution

- Derive the `sso-oidc` endpoint family from the format of the configured `sso_start_url` (a `*.app.aws` start URL implies dual-stack endpoints), or
- Have `StartDeviceAuthorization` return a `verificationUriComplete` in the same endpoint family as the registered start URL (this part may be service-side rather than CLI-side), and/or
- Document the requirement to set `use_dualstack_endpoint = true` when the Identity Center instance/IdP has been migrated to dual-stack endpoints, and surface a clearer error than "Something doesn't compute."

### Additional Information/Context

_No response_

### CLI version used

aws-cli/2.35.21 Python/3.14.6

### Environment details (OS name and version, etc.)

Linux/7.0.0-27-generic exe/x86_64.ubuntu.26