(infra-cdk): Compliance mode CDK preset for regulated deployments

## Component

CDK / infrastructure

## Describe the feature

Add a single stack-level **`complianceMode`** (or similarly named) prop that enables a documented bundle of stricter defaults for regulated environments: VPC-only egress posture, DNS firewall enforcement path, immutable audit export hooks, org budget alarms, and conservative Blueprint defaults—without operators hand-toggling a dozen props.

## Use case

Regulated operators need a **governed internal deployment** that satisfies security review quickly. Without a controlled internal path, teams adopt unsanctioned desktop agents (**shadow IT**). Default-deny egress and VPC-resident deployment are common requirements. Piecemeal configuration is error-prone; reviewers want a named preset with an attached threat model and delta from standard deploy.

## Proposed solution

1. `complianceMode: boolean` on root stack props (default `false`).
2. When `true`, wire documented overrides: e.g. DNS firewall not observation-only, enable **Immutable audit export** scaffolding, stricter WAF defaults, require private subnets documentation check.
3. Publish `docs/guides/COMPLIANCE_DEPLOYMENT.md` (source; sync Starlight) listing what the preset changes and what remains operator responsibility.
4. `cdk diff` banner when mode enabled summarizing enforced controls.

## Other information

- Does not certify SOC2/PCI by itself; documents alignment with roadmap **Org and team budgets**, **Immutable audit export**, **Zero Trust control review**.
- Pairs with existing VPC deployment guide.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] `complianceMode` prop exists and is covered by synth test.
- [ ] Compliance guide lists every prop side-effect.
- [ ] Standard deploy behavior unchanged when flag is false.
- [ ] cdk-nag / security suppressions documented where preset requires them.

Beginne damit, die Props des Root-Stacks, den bestehenden VPC-Bereitstellungsleitfaden, die Synth-Tests und die Behandlung von cdk diff zu lokalisieren. Überprüfe, wie die aktuellen Bereitstellungskontrollen und die Blueprint-Defaults verdrahtet sind, bevor du das Compliance-Preset und seine dokumentierten Nebeneffekte definierst. Erledigt ist die Aufgabe, wenn der Prop, die Synth-Abdeckung, der Compliance-Leitfaden, das unveränderte Verhalten bei false und die erforderliche Dokumentation der Suppressionen die Akzeptanzkriterien erfüllen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.