fix(cdk): lambda-microvm grants hardcode the us. inference-profile prefix instead of bedrockGeoRegion #955

Summary

cdk/src/constructs/lambda-microvm-compute.ts builds the Bedrock inference-profile grant ARN with a hardcoded prefix:

resource: 'inference-profile',
resourceName: `us.${modelId}`,

The AgentCore runtime (stacks/agent.ts) and ECS (constructs/ecs-agent-cluster.ts) derive the prefix from resolveBedrockGeoRegion and inject the same geo into ANTHROPIC_MODEL / ANTHROPIC_DEFAULT_HAIKU_MODEL. The Lambda MicroVM backend therefore grants us.* profiles while the agent is told to invoke <geo>.*.

Impact

Any bedrockGeoRegion other than us (the shipped cdk.json sets global) on the lambda-microvm backend fails every task at turn 0 with AccessDenied — the exact grant/env drift bedrock-model-constants.ts documents as the failure mode to avoid. Pre-existing; surfaced during review of #954.

Fix

• Import resolveBedrockGeoRegion (or accept bedrockGeoRegion as a prop, matching ECS) and use inferenceProfileId(geo, modelId) for the ARN.
• Add a test.each(['global', 'eu']) case mirroring cdk/test/constructs/ecs-agent-cluster.test.ts ("bedrockGeoRegion=%s injects both models…") that asserts the MicroVM role's inference-profile/<geo>.<model> ARNs and the absence of us. ones.

Acceptance

• bedrockGeoRegion=global synth grants inference-profile/global.* on the MicroVM execution role and no us.*.
• Existing us default unchanged.