Can Zero-Shot Commercial APIs Deliver Regulatory-Grade Clinical Text DeIdentification?