feat(observability): security operations metrics (dwell time and coverage)

**Context:** ROADMAP.md → Security operations metrics (dwell time and coverage)

---

## Component

CDK / infrastructure

## Describe the feature

CloudWatch **metrics and dashboard panels**: time from anomaly (circuit breaker trip, guardrail spike, policy deny burst) to **operator awareness**; fraction of security/ops alarms **investigated**. Targets shortened exploit windows.

## Use case

Security teams measure detection-to-response, not just alert firing. Uninvestigated alarms indicate process gaps.

## Proposed solution

1. Metric: `security_anomaly_to_ack_seconds` (anomaly event → first operator action or ticket).
2. Metric: `security_alarms_investigated_ratio` (manual tag or integration hook).
3. Dashboard row on operator dashboard.
4. Optional integration with PagerDuty/Opsgenie ack timestamps.

## Other information

- Pairs with behavioral circuit breaker and automated alert triage drafts.
- Design context: `docs/design/OBSERVABILITY.md`, `docs/design/SECURITY.md`.

- [ ] This might be a breaking change

Inizia leggendo docs/design/OBSERVABILITY.md e docs/design/SECURITY.md, quindi segui i punti di ingresso CDK / infrastruttura per la dashboard dell’operatore e le metriche di allarme esistenti. Definisci come vengono raccolti i dati di anomaly-to-ack e investigated-ratio, aggiungi le metriche nominate e la riga della dashboard, quindi verifica il comportamento opzionale di PagerDuty/Opsgenie, se supportato.

Scritto dal modello di indicizzazione a partire dal testo della issue.