feat(ci): proactive deprecation and warning triage across build pipeline

## Problem

Build, test, lint, and synth steps emit deprecation warnings and non-fatal diagnostics that go unnoticed until they become breaking changes. By the time they break, the upgrade path is harder (multiple breaking changes compound). Examples from `//cdk:test`:

### 1. ts-jest hybrid module warning
```
WARN ts-jest[config] (WARN) message TS151002: Using hybrid module kind (Node16/18/Next) is only
supported in "isolatedModules: true". Please set "isolatedModules: true" in your tsconfig.json.
```
**Risk:** ts-jest may enforce this in a future major version, breaking all tests.

### 2. CDK deprecated API usage
```
WARNING [WARNING] aws-cdk-lib.aws_iam.GrantOnPrincipalOptions#scope is deprecated.
```
**Risk:** Removed in a future aws-cdk-lib major version. Every CDK upgrade will surface more of these until addressed.

### Other known warnings (from CI logs)
- ESLint `@cdklabs` rules using removed `context.getFilename()` (#170)
- ESLint `no-constant-condition` deprecated in ESLint 10 (already handled in #171)

## Proposal

Establish a recurring process (manual or automated) that:

1. **Captures** — Collects all WARN/WARNING/deprecated output from `mise run build`
2. **Triages** — Categorizes by severity (breaking-soon vs cosmetic) and ownership
3. **Tracks** — Files issues for each actionable deprecation before it becomes a blocker
4. **Prevents regression** — Optionally, CI fails on NEW warnings (warnings-as-errors for net-new)

### Implementation options (progressive)

| Approach | Effort | Coverage |
|----------|--------|----------|
| Periodic manual audit (run build, grep warnings, file issues) | Low | Reactive |
| CI step that captures warnings to artifact for review | Medium | Passive visibility |
| CI step that fails on net-new warnings (baseline file of known warnings) | High | Preventive |

### Relation to ADR-013 (proposed)

This aligns with ADR-013's Tier 1 (package-level build gates). A "no new warnings" policy would be a Tier 1 enforcement mechanism.

## Immediate action items

- [ ] Fix ts-jest `isolatedModules` warning (`cdk/tsconfig.dev.json`)
- [ ] Triage `GrantOnPrincipalOptions#scope` deprecation (update CDK code to use non-deprecated API)
- [ ] Add to #89 or close #89 if subsumed here

## References

- #89 — Remediate CDK Warnings (narrower scope: CDK-nag + context flags only)
- #104 — Automated toolchain version monitoring (dependency versions, not build warnings)
- #170 — @cdklabs ESLint plugin deprecation
- ADR-013 (proposed) — Tiered validation pyramid

Beginne mit `mise run build` und erfasse die im Issue beschriebenen Warnungen. Prüfe anschließend `cdk/tsconfig.dev.json` sowie die CI-/Build-Konfiguration. Prüfe #89, #104, #170 und ADR-013, um Umfang und Zuständigkeit zu bestimmen. Als erledigt gilt die Aufgabe, wenn das Projekt über einen abgestimmten Prozess zur Erfassung und Triage von Warnungen verfügt und die aufgeführten umsetzbaren Warnungen nachverfolgt oder behoben sind.

Vom Indexierungsmodell aus dem Issue-Text verfasst.