feat(bootstrap): CDK Aspect for policy envelope checking

## Parent

Sub-issue 5 of #120 (RFC: Least-privilege CDK bootstrap policies as code)

## Branch strategy

`feat/bootstrap-aspect` → targets `feat/bootstrap-action-map`

## Estimated review time: ~30 min

## Summary

Implement a CDK Aspect that runs during `cdk synth` and validates every CfnResource's required IAM actions are covered by the declared bootstrap policy envelope. This catches "your new construct needs permissions the bootstrap role doesn't have" at dev time — before a failed deploy.

## Deliverables

- [ ] Create `cdk/src/bootstrap/preflight/aspect.ts`:
- `BootstrapPolicyAspect` implementing `IAspect`
- Visits all `CfnResource` nodes in the construct tree
- Looks up each resource type in the resource-action-map
- Compares required actions against the combined action set from all three policies
- Emits `Annotations.of(node).addError()` for actions absent from all policy versions
- Emits `Annotations.of(node).addWarning()` for:
- Actions in a newer policy version than currently declared
- Resource types not found in the map (unknown/unmapped)
- [ ] Register Aspect in `cdk/src/main.ts` alongside existing `AwsSolutionsChecks`:
```typescript
Aspects.of(app).add(new BootstrapPolicyAspect());
```
- [ ] Create `cdk/test/bootstrap/aspect.test.ts`:
- Covered resource type → no annotations (pass)
- Uncovered resource type (requires action not in any policy) → error annotation
- Unknown resource type (not in map) → warning annotation
- Policy version mismatch (action exists in v2 but current is v1) → warning with upgrade message
- Validates Aspect does not interfere with cdk-nag Aspect
- [ ] Verify: `mise //cdk:synth` passes cleanly with current policies and current resources

## Key design decisions

- Aspect runs **after** cdk-nag in the Aspect registration order (cdk-nag validates runtime IAM; this validates deployment IAM — different concerns)
- **Error** = deploy will fail. **Warning** = deploy may succeed but policy is stale.
- Aspect is **enabled by default** but can be disabled via CDK context flag (`bootstrapPolicyCheck: false`) for escape-hatch scenarios
- Does not modify the template — read-only inspection only

## Acceptance criteria

- `mise //cdk:synth` passes with zero errors on current codebase (all resources are covered by current policies)
- Adding a hypothetical uncovered resource type in a test produces the expected error annotation
- Existing cdk-nag suppressions are not affected
- `mise //cdk:test` passes