feat(infra): shared SNS alarm-notification plane (wire bare CloudWatch alarms) — AC5 of #284

Parent context: deferred AC5 of #284 (surfaced during PR #674 review by @theagenticguy). **Needs maintainer `approved` before implementation (ADR-003).**

## Finding
Every CloudWatch alarm in `cdk/src` is a **bare alarm with no notification action** — nothing pages an operator; the signal is only visible to someone already watching the CloudWatch console. Current bare alarms:

- `WebhookProcessorDlqDepthAlarm` + `WebhookProcessorErrorAlarm` (`github-screenshot-integration.ts`)
- `FanOutConsumer.dlqDepthAlarm` (`fanout-consumer.ts`)
- `OrchestratorErrorAlarm` (`task-orchestrator.ts`)
- `ApprovalMetricsPublisherConsumer` alarm (`approval-metrics-publisher-consumer.ts`)

#284's AC5 asked for notification. PR #674 deliberately did **not** one-off an SNS topic on the webhook alarm (correct restraint — a per-alarm topic would be the wrong shape), and #674 therefore uses `Refs #284`, leaving #284 open for this.

## Scope
- Stand up a **shared SNS notification plane** (one topic, or a small construct) that alarms across the app can wire an `addAlarmAction` to.
- Retrofit the existing bare alarms above to publish to it.
- Decide subscription delivery (email/chatbot/PagerDuty) as a config input, not hardcoded.
- Consider cdk-nag implications + a documented subscription-management runbook.

## Closes
This satisfies #284's AC5. Once shipped, **#284 can close** (it is currently held open as DONE-NO-CLOSE tracking exactly this gap).

Refs #284

Empieza leyendo ADR-003 y las alarmas existentes en cdk/src: github-screenshot-integration.ts, fanout-consumer.ts, task-orchestrator.ts y approval-metrics-publisher-consumer.ts. Define el construct compartido de notificaciones de SNS y la entrada configurable de suscripciones antes de conectar cada alarma; se considera terminado cuando todas las alarmas indicadas publiquen a través de él, se hayan abordado las implicaciones de cdk-nag y el runbook de gestión de suscripciones esté documentado.

Escrito por el modelo de indexación a partir del texto del issue.