feat(infra): shared SNS alarm-notification plane (wire bare CloudWatch alarms) — AC5 of #284

Parent context: deferred AC5 of #284 (surfaced during PR #674 review by @theagenticguy). **Needs maintainer `approved` before implementation (ADR-003).**

## Finding
Every CloudWatch alarm in `cdk/src` is a **bare alarm with no notification action** — nothing pages an operator; the signal is only visible to someone already watching the CloudWatch console. Current bare alarms:

- `WebhookProcessorDlqDepthAlarm` + `WebhookProcessorErrorAlarm` (`github-screenshot-integration.ts`)
- `FanOutConsumer.dlqDepthAlarm` (`fanout-consumer.ts`)
- `OrchestratorErrorAlarm` (`task-orchestrator.ts`)
- `ApprovalMetricsPublisherConsumer` alarm (`approval-metrics-publisher-consumer.ts`)

#284's AC5 asked for notification. PR #674 deliberately did **not** one-off an SNS topic on the webhook alarm (correct restraint — a per-alarm topic would be the wrong shape), and #674 therefore uses `Refs #284`, leaving #284 open for this.

## Scope
- Stand up a **shared SNS notification plane** (one topic, or a small construct) that alarms across the app can wire an `addAlarmAction` to.
- Retrofit the existing bare alarms above to publish to it.
- Decide subscription delivery (email/chatbot/PagerDuty) as a config input, not hardcoded.
- Consider cdk-nag implications + a documented subscription-management runbook.

## Closes
This satisfies #284's AC5. Once shipped, **#284 can close** (it is currently held open as DONE-NO-CLOSE tracking exactly this gap).

Refs #284

Inizia leggendo ADR-003 e gli allarmi esistenti in cdk/src: github-screenshot-integration.ts, fanout-consumer.ts, task-orchestrator.ts e approval-metrics-publisher-consumer.ts. Definisci il construct condiviso per le notifiche SNS e l’input configurabile per le sottoscrizioni prima di collegarvi ciascun allarme; il lavoro è completato quando tutti gli allarmi elencati pubblicano tramite questo construct, le implicazioni di cdk-nag sono state affrontate e il runbook per la gestione delle sottoscrizioni è documentato.

Scritto dal modello di indicizzazione a partire dal testo della issue.