fix(workshop): bind CDK environment and use supported AgentCore AZs

[ayushtr-aws]

Summary

• derive CDK_DEFAULT_ACCOUNT from the active AWS caller and bind CDK_DEFAULT_REGION to the workshop region
• resolve AgentCore-supported zone IDs to account-local availability-zone names
• constrain the workshop VPC to those resolved zones while preserving default AZ selection elsewhere
• add focused construct and stack coverage

Validation

• mise run build
• 4,095 CDK tests passed
• 1,583 agent tests passed
• focused AgentCore AZ tests passed (113/113)
• bash -n manage-workshop-stack.sh
• verified production code contains no test-account IDs

Closes #789