feat(jobs): use organization.allowedRegions for --run-region completion (Vibe Kanban)

[ClayMav]

Summary

Addresses @sfishel18's review feedback on #26:

nit: should filter down to available+enabled regions. or might be easier to use the organization.allowedRegions list instead

Switches shell completion for --run-region to source from organization.allowedRegions instead of regions.hint in /notebooks/config-hint. PR #26 has already been merged; this PR is a follow-up implementing the reviewer's suggestion.

What changed

• --run-region completion: now calls GET /organization and reads allowedRegions[]. This is the authoritative list of regions the org can actually use.
• --runtime completion: unchanged source (GET /notebooks/config-hint → runtimes.hint[].id, filtered by enabled). Runtimes don't have an availability dimension, only enabled, so the previous filter was already correct for them.
• Refactor: the previous completeConfigHint helper was generic over arrayPath/valueKey to share logic between regions and runtimes. With regions moving to a different endpoint and response shape, that abstraction no longer pulled its weight — replaced with a small fetchForCompletion helper (timeout + execOnce) and two focused completion functions.
• Tests: added TestCompleteRegionsReturnsAllowedRegions, TestCompleteRegionsFailsOpenOnError, and TestCompleteRuntimesSkipsDisabled. Extracted the shared runtime spec used by the jobs test fixture into a jobsTestRuntimeSpec helper so the new tests can reuse it.

Why

The old source (regions.hint[].regionName with an enabled filter) let through regions whose availability is DEGRADED, UNAVAILABLE, or DISABLED — those would surface in tab completion but fail at run time. organization.allowedRegions is the list the backend uses to decide what's valid for this org, so completion now matches the runtime contract.

Implementation notes

• Both completion functions still fail open — on missing operation, missing context, timeout, or HTTP error they return nil with ShellCompDirectiveNoFileComp, so completion never blocks the user.
• 5s timeout (unchanged) on the completion request.
• getOrganization was already a required dependency for newJobsRunner (used for managed-storage resolution), so no new failure modes are introduced.
• The /notebooks/config-hint operation is still loaded so runtime completion keeps working — it remains optional (completion no-ops when the op isn't in the spec).

Test plan

• go test ./... — all packages pass, including the three new completion tests.
• go vet ./... — clean.
• gofmt -l . — clean.

---

This PR was written using Vibe Kanban