(infra-cdk): Compliance mode CDK preset for regulated deployments

## Component

CDK / infrastructure

## Describe the feature

Add a single stack-level **`complianceMode`** (or similarly named) prop that enables a documented bundle of stricter defaults for regulated environments: VPC-only egress posture, DNS firewall enforcement path, immutable audit export hooks, org budget alarms, and conservative Blueprint defaults—without operators hand-toggling a dozen props.

## Use case

Regulated operators need a **governed internal deployment** that satisfies security review quickly. Without a controlled internal path, teams adopt unsanctioned desktop agents (**shadow IT**). Default-deny egress and VPC-resident deployment are common requirements. Piecemeal configuration is error-prone; reviewers want a named preset with an attached threat model and delta from standard deploy.

## Proposed solution

1. `complianceMode: boolean` on root stack props (default `false`).
2. When `true`, wire documented overrides: e.g. DNS firewall not observation-only, enable **Immutable audit export** scaffolding, stricter WAF defaults, require private subnets documentation check.
3. Publish `docs/guides/COMPLIANCE_DEPLOYMENT.md` (source; sync Starlight) listing what the preset changes and what remains operator responsibility.
4. `cdk diff` banner when mode enabled summarizing enforced controls.

## Other information

- Does not certify SOC2/PCI by itself; documents alignment with roadmap **Org and team budgets**, **Immutable audit export**, **Zero Trust control review**.
- Pairs with existing VPC deployment guide.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] `complianceMode` prop exists and is covered by synth test.
- [ ] Compliance guide lists every prop side-effect.
- [ ] Standard deploy behavior unchanged when flag is false.
- [ ] cdk-nag / security suppressions documented where preset requires them.

Empieza por localizar las props del root stack, la guía existente de despliegue de VPC, las pruebas de synth y el manejo de cdk diff. Revisa cómo están conectados los controles de despliegue actuales y los valores predeterminados de Blueprint antes de definir el preset de compliance y sus efectos secundarios documentados. Se considera terminado cuando el prop, la cobertura de synth, la guía de compliance, el comportamiento sin cambios con false y la documentación de supresión requerida cumplen los criterios de aceptación.

Escrito por el modelo de indexación a partir del texto del issue.