feat(infra): EventBridge/SNS task lifecycle event bus

**Context:** ROADMAP.md → EventBridge / SNS integration
**Related:** #228 (DLQ→SNS alarms only—not lifecycle events)

---

## Component

CDK / infrastructure

## Describe the feature

Publish **task lifecycle events** to **EventBridge** or **SNS** for external consumers beyond built-in DDB-Stream fanout (GitHub/Slack/email).

## Use case

Enterprises integrate ABCA with SIEM, internal workflow tools, or data warehouses. Fanout is channel-specific, not a general integration bus.

## Proposed solution

1. EventBridge bus + rules: `task.submitted`, `task.running`, `task.completed`, `task.failed`, `approval.required`, etc.
2. Optional SNS topic fan-out for simpler subscribers.
3. CDK opt-in; schema registry for event detail types.
4. IAM for cross-account publish (optional).
5. Document in `docs/design/API_CONTRACT.md` extension index.

## Other information

- Not the same as #228 (webhook processor DLQ alarms).
- Design context: `docs/design/OBSERVABILITY.md`, `docs/design/INPUT_GATEWAY.md`.

- [ ] This might be a breaking change

Start with ROADMAP.md and then read docs/design/OBSERVABILITY.md, docs/design/INPUT_GATEWAY.md, and docs/design/API_CONTRACT.md. The issue does not identify CDK entry points, event producers, schemas, tests, or a decision between EventBridge and SNS; those boundaries and acceptance criteria must be settled before implementation is considered done.

Written by the indexing model from the issue text.