(infra-cdk): Compliance mode CDK preset for regulated deployments

## Component

CDK / infrastructure

## Describe the feature

Add a single stack-level **`complianceMode`** (or similarly named) prop that enables a documented bundle of stricter defaults for regulated environments: VPC-only egress posture, DNS firewall enforcement path, immutable audit export hooks, org budget alarms, and conservative Blueprint defaults—without operators hand-toggling a dozen props.

## Use case

Regulated operators need a **governed internal deployment** that satisfies security review quickly. Without a controlled internal path, teams adopt unsanctioned desktop agents (**shadow IT**). Default-deny egress and VPC-resident deployment are common requirements. Piecemeal configuration is error-prone; reviewers want a named preset with an attached threat model and delta from standard deploy.

## Proposed solution

1. `complianceMode: boolean` on root stack props (default `false`).
2. When `true`, wire documented overrides: e.g. DNS firewall not observation-only, enable **Immutable audit export** scaffolding, stricter WAF defaults, require private subnets documentation check.
3. Publish `docs/guides/COMPLIANCE_DEPLOYMENT.md` (source; sync Starlight) listing what the preset changes and what remains operator responsibility.
4. `cdk diff` banner when mode enabled summarizing enforced controls.

## Other information

- Does not certify SOC2/PCI by itself; documents alignment with roadmap **Org and team budgets**, **Immutable audit export**, **Zero Trust control review**.
- Pairs with existing VPC deployment guide.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] `complianceMode` prop exists and is covered by synth test.
- [ ] Compliance guide lists every prop side-effect.
- [ ] Standard deploy behavior unchanged when flag is false.
- [ ] cdk-nag / security suppressions documented where preset requires them.

Start by locating the root stack props, existing VPC deployment guide, synth tests, and cdk diff handling. Review how current deployment controls and Blueprint defaults are wired before defining the compliance preset and its documented side effects. Done means the prop, synth coverage, compliance guide, unchanged false behavior, and required suppression documentation satisfy the acceptance criteria.

Written by the indexing model from the issue text.