Hold cdk-nag on 2.x: 3.x cannot express this stack's IAM suppressions

Tracking issue for the cdk-nag 3.x upgrade. It exists so the analysis survives Dependabot recreating its PR — the original evidence is on #16 (closed), and Dependabot will open a fresh cdk-nag 3.x PR on its next weekly run. **Close that PR against this issue rather than merging it.**

## Current state

`cdk-nag==2.38.2` pinned in `pyproject.toml`, with `aws-cdk-lib==2.261.0` and `constructs==10.6.0`. `cdk synth` is clean: 48 resources, 46 rules evaluated, 29 suppressed, 0 non-compliant. This is not a dependency-floor conflict — the pins already satisfy 3.0.x's own floors (`aws-cdk-lib>=2.257.0`, `constructs>=10.5.1`).

## Why 3.x is blocked

cdk-nag 3.x has three breaking changes. Two are mechanical:

1. `NagSuppressions` / `NagPackSuppression` are removed; suppressions move to CDK core `Validations.of(scope).acknowledge(Acknowledgment(...))`.
2. A pack is no longer an aspect — registration moves from `Aspects.of(app).add(...)` to `Validations.of(app).add_plugins(...)`. Leaving the aspect call fails at synth with `TypeError: aspectApplication.aspect.visit is not a function`.

The third is the blocker:

3. Granular rules (`AwsSolutions-IAM4`, `-IAM5`) are keyed by a **composite** id, `Rule[Finding]`. `NagPack.applyRule` only checks `isAcknowledged(node, ${ruleId}[${finding}])` with no fallback to the bare id, so a blanket `AwsSolutions-IAM5` suppresses nothing. This stack then needs 19 acknowledgements — and `Validations.qualifyId` in aws-cdk-lib rejects any id whose `split("::")` yields more than two parts, which every ARN-bearing finding trips (``, `iam::aws:policy`, `s3:::bucket`, `*::foundation-model`).

Measured directly by feeding all 19 required ids to `Validations.acknowledge`:

| aws-cdk-lib | Accepted | Rejected |
|---|---|---|
| 2.261.0 (pinned here) | 8 of 19 | 11 |
| 2.266.0 (latest) | 8 of 19 | 11 |

Identical on both, so a paired `aws-cdk-lib` bump does not unblock it. cdk-nag prints remediation advice that CDK core refuses to accept:

```
Acknowledge with 'AwsSolutions-IAM5[Resource::arn:aws:bedrock:*::foundation-model/anthropic.claude-*]'
```
```
RuntimeError: InvalidValidationId: ... The '::' delimiter is reserved for separating
the prefix from the rule name (e.g. 'prefix::RuleName').
```

The 11 rejections cover both `AwsSolutions-IAM4` managed-policy findings and every AgentCore Runtime finding for CloudWatch Logs, S3 assets, workload identity, and the Bedrock inference profiles.

## Unblock criteria

Either of:

- `Validations.qualifyId` permits `::` inside a rule name, or
- cdk-nag stops embedding raw ARNs in acknowledgement ids (its README notes ergonomic prefix matching is still planned).

## Note for whoever does the migration

Five of the 19 required ids embed the deploy account and Region (log-group ARNs, the workload-identity-directory ARN, `cdk-hnb659fds-assets--`). Hard-coding them would break this sample for anyone deploying to a different account or Region, so the acknowledgements must be built dynamically at synth time rather than written as literals.

CI now catches this: #38 added a `cdk synth` gate to the `quality` job, so a cdk-nag 3.x PR fails with `AttributeError: module 'cdk_nag' has no attribute 'NagSuppressions'` instead of showing a green check that never exercised the app.

Start with pyproject.toml and the current cdk synth flow; review the cdk-nag 3.x migration evidence from #16 and the CI gate added in #38. Do not migrate while the acknowledgement IDs remain rejected. Done means a future Dependabot PR satisfies the stated unblock criteria, synthesizes successfully, and is closed against this issue rather than merged.

Written by the indexing model from the issue text.