feat(infra): shared SNS alarm-notification plane (wire bare CloudWatch alarms) — AC5 of #284

Parent context: deferred AC5 of #284 (surfaced during PR #674 review by @theagenticguy). **Needs maintainer `approved` before implementation (ADR-003).**

## Finding
Every CloudWatch alarm in `cdk/src` is a **bare alarm with no notification action** — nothing pages an operator; the signal is only visible to someone already watching the CloudWatch console. Current bare alarms:

- `WebhookProcessorDlqDepthAlarm` + `WebhookProcessorErrorAlarm` (`github-screenshot-integration.ts`)
- `FanOutConsumer.dlqDepthAlarm` (`fanout-consumer.ts`)
- `OrchestratorErrorAlarm` (`task-orchestrator.ts`)
- `ApprovalMetricsPublisherConsumer` alarm (`approval-metrics-publisher-consumer.ts`)

#284's AC5 asked for notification. PR #674 deliberately did **not** one-off an SNS topic on the webhook alarm (correct restraint — a per-alarm topic would be the wrong shape), and #674 therefore uses `Refs #284`, leaving #284 open for this.

## Scope
- Stand up a **shared SNS notification plane** (one topic, or a small construct) that alarms across the app can wire an `addAlarmAction` to.
- Retrofit the existing bare alarms above to publish to it.
- Decide subscription delivery (email/chatbot/PagerDuty) as a config input, not hardcoded.
- Consider cdk-nag implications + a documented subscription-management runbook.

## Closes
This satisfies #284's AC5. Once shipped, **#284 can close** (it is currently held open as DONE-NO-CLOSE tracking exactly this gap).

Refs #284

まず ADR-003 と、cdk/src にある既存のアラーム（github-screenshot-integration.ts、fanout-consumer.ts、task-orchestrator.ts、approval-metrics-publisher-consumer.ts）を読みます。各アラームを接続する前に、共有 SNS 通知 construct と設定可能なサブスクリプション入力を定義します。完了の条件は、一覧にあるすべてのアラームがそれを介して発行し、cdk-nag の影響に対処し、サブスクリプション管理の runbook が文書化されていることです。

索引モデルが issue の本文から書いたものです。