(infra-cdk): Compliance mode CDK preset for regulated deployments

## Component

CDK / infrastructure

## Describe the feature

Add a single stack-level **`complianceMode`** (or similarly named) prop that enables a documented bundle of stricter defaults for regulated environments: VPC-only egress posture, DNS firewall enforcement path, immutable audit export hooks, org budget alarms, and conservative Blueprint defaults—without operators hand-toggling a dozen props.

## Use case

Regulated operators need a **governed internal deployment** that satisfies security review quickly. Without a controlled internal path, teams adopt unsanctioned desktop agents (**shadow IT**). Default-deny egress and VPC-resident deployment are common requirements. Piecemeal configuration is error-prone; reviewers want a named preset with an attached threat model and delta from standard deploy.

## Proposed solution

1. `complianceMode: boolean` on root stack props (default `false`).
2. When `true`, wire documented overrides: e.g. DNS firewall not observation-only, enable **Immutable audit export** scaffolding, stricter WAF defaults, require private subnets documentation check.
3. Publish `docs/guides/COMPLIANCE_DEPLOYMENT.md` (source; sync Starlight) listing what the preset changes and what remains operator responsibility.
4. `cdk diff` banner when mode enabled summarizing enforced controls.

## Other information

- Does not certify SOC2/PCI by itself; documents alignment with roadmap **Org and team budgets**, **Immutable audit export**, **Zero Trust control review**.
- Pairs with existing VPC deployment guide.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] `complianceMode` prop exists and is covered by synth test.
- [ ] Compliance guide lists every prop side-effect.
- [ ] Standard deploy behavior unchanged when flag is false.
- [ ] cdk-nag / security suppressions documented where preset requires them.

Commencez par localiser les props du root stack, le guide de déploiement VPC existant, les tests de synth et la gestion de cdk diff. Examinez comment les contrôles de déploiement actuels et les valeurs par défaut de Blueprint sont reliés avant de définir le preset de compliance et ses effets secondaires documentés. C’est terminé lorsque le prop, la couverture de synth, le guide de compliance, le comportement inchangé avec false et la documentation requise des suppressions respectent les critères d’acceptation.

Rédigé par le modèle d'indexation à partir du texte de l'issue.