feat(ci): proactive deprecation and warning triage across build pipeline

## Problem

Build, test, lint, and synth steps emit deprecation warnings and non-fatal diagnostics that go unnoticed until they become breaking changes. By the time they break, the upgrade path is harder (multiple breaking changes compound). Examples from `//cdk:test`:

### 1. ts-jest hybrid module warning
```
WARN ts-jest[config] (WARN) message TS151002: Using hybrid module kind (Node16/18/Next) is only
supported in "isolatedModules: true". Please set "isolatedModules: true" in your tsconfig.json.
```
**Risk:** ts-jest may enforce this in a future major version, breaking all tests.

### 2. CDK deprecated API usage
```
WARNING [WARNING] aws-cdk-lib.aws_iam.GrantOnPrincipalOptions#scope is deprecated.
```
**Risk:** Removed in a future aws-cdk-lib major version. Every CDK upgrade will surface more of these until addressed.

### Other known warnings (from CI logs)
- ESLint `@cdklabs` rules using removed `context.getFilename()` (#170)
- ESLint `no-constant-condition` deprecated in ESLint 10 (already handled in #171)

## Proposal

Establish a recurring process (manual or automated) that:

1. **Captures** — Collects all WARN/WARNING/deprecated output from `mise run build`
2. **Triages** — Categorizes by severity (breaking-soon vs cosmetic) and ownership
3. **Tracks** — Files issues for each actionable deprecation before it becomes a blocker
4. **Prevents regression** — Optionally, CI fails on NEW warnings (warnings-as-errors for net-new)

### Implementation options (progressive)

| Approach | Effort | Coverage |
|----------|--------|----------|
| Periodic manual audit (run build, grep warnings, file issues) | Low | Reactive |
| CI step that captures warnings to artifact for review | Medium | Passive visibility |
| CI step that fails on net-new warnings (baseline file of known warnings) | High | Preventive |

### Relation to ADR-013 (proposed)

This aligns with ADR-013's Tier 1 (package-level build gates). A "no new warnings" policy would be a Tier 1 enforcement mechanism.

## Immediate action items

- [ ] Fix ts-jest `isolatedModules` warning (`cdk/tsconfig.dev.json`)
- [ ] Triage `GrantOnPrincipalOptions#scope` deprecation (update CDK code to use non-deprecated API)
- [ ] Add to #89 or close #89 if subsumed here

## References

- #89 — Remediate CDK Warnings (narrower scope: CDK-nag + context flags only)
- #104 — Automated toolchain version monitoring (dependency versions, not build warnings)
- #170 — @cdklabs ESLint plugin deprecation
- ADR-013 (proposed) — Tiered validation pyramid