feat(observability): security operations metrics (dwell time and coverage)

**Context:** ROADMAP.md → Security operations metrics (dwell time and coverage)

---

## Component

CDK / infrastructure

## Describe the feature

CloudWatch **metrics and dashboard panels**: time from anomaly (circuit breaker trip, guardrail spike, policy deny burst) to **operator awareness**; fraction of security/ops alarms **investigated**. Targets shortened exploit windows.

## Use case

Security teams measure detection-to-response, not just alert firing. Uninvestigated alarms indicate process gaps.

## Proposed solution

1. Metric: `security_anomaly_to_ack_seconds` (anomaly event → first operator action or ticket).
2. Metric: `security_alarms_investigated_ratio` (manual tag or integration hook).
3. Dashboard row on operator dashboard.
4. Optional integration with PagerDuty/Opsgenie ack timestamps.

## Other information

- Pairs with behavioral circuit breaker and automated alert triage drafts.
- Design context: `docs/design/OBSERVABILITY.md`, `docs/design/SECURITY.md`.

- [ ] This might be a breaking change

Empieza leyendo docs/design/OBSERVABILITY.md y docs/design/SECURITY.md; después, sigue los puntos de entrada de CDK / infraestructura del panel del operador y de las métricas de alerta existentes. Define cómo se recopilan los datos de anomaly-to-ack e investigated-ratio, añade las métricas nombradas y la fila del panel, y verifica el comportamiento opcional de PagerDuty/Opsgenie si es compatible.

Escrito por el modelo de indexación a partir del texto del issue.