fix: export gateway role ARN as a CfnOutput for cross-stack reference

## Description

Add a `CfnOutput` for the gateway role ARN in `lib/nested/gateway-stack.ts`. This enables the resource-based policies stack to reference the gateway role without importing the full construct.

## What to do

In `lib/nested/gateway-stack.ts`, add after the existing CfnOutputs (around line 71):

```typescript
new cdk.CfnOutput(this, "GatewayRoleArn", { value: this.gateway.gatewayRole.roleArn });
```

## Acceptance Criteria

- [ ] `GatewayRoleArn` CfnOutput added to the gateway stack
- [ ] `npx cdk synth --quiet` passes
- [ ] `npm test` passes
- [ ] No other files modified

## Files

```
lib/nested/gateway-stack.ts MODIFY — add one CfnOutput line
```

Open lib/nested/gateway-stack.ts and inspect the existing CfnOutputs around line 71 and the gateway role reference. Add the specified GatewayRoleArn output, then run npx cdk synth --quiet and npm test. Done means both commands pass and only lib/nested/gateway-stack.ts is modified.

Written by the indexing model from the issue text.