feat(infra): shared SNS alarm-notification plane (wire bare CloudWatch alarms) — AC5 of #284

Parent context: deferred AC5 of #284 (surfaced during PR #674 review by @theagenticguy). **Needs maintainer `approved` before implementation (ADR-003).**

## Finding
Every CloudWatch alarm in `cdk/src` is a **bare alarm with no notification action** — nothing pages an operator; the signal is only visible to someone already watching the CloudWatch console. Current bare alarms:

- `WebhookProcessorDlqDepthAlarm` + `WebhookProcessorErrorAlarm` (`github-screenshot-integration.ts`)
- `FanOutConsumer.dlqDepthAlarm` (`fanout-consumer.ts`)
- `OrchestratorErrorAlarm` (`task-orchestrator.ts`)
- `ApprovalMetricsPublisherConsumer` alarm (`approval-metrics-publisher-consumer.ts`)

#284's AC5 asked for notification. PR #674 deliberately did **not** one-off an SNS topic on the webhook alarm (correct restraint — a per-alarm topic would be the wrong shape), and #674 therefore uses `Refs #284`, leaving #284 open for this.

## Scope
- Stand up a **shared SNS notification plane** (one topic, or a small construct) that alarms across the app can wire an `addAlarmAction` to.
- Retrofit the existing bare alarms above to publish to it.
- Decide subscription delivery (email/chatbot/PagerDuty) as a config input, not hardcoded.
- Consider cdk-nag implications + a documented subscription-management runbook.

## Closes
This satisfies #284's AC5. Once shipped, **#284 can close** (it is currently held open as DONE-NO-CLOSE tracking exactly this gap).

Refs #284

Start by reading ADR-003 and the existing alarms in cdk/src: github-screenshot-integration.ts, fanout-consumer.ts, task-orchestrator.ts, and approval-metrics-publisher-consumer.ts. Define the shared SNS notification construct and configurable subscription input before wiring each alarm; done means all listed alarms publish through it, cdk-nag implications are addressed, and the subscription-management runbook is documented.

Written by the indexing model from the issue text.