fix(policy): deploy --enforcement-mode through CDK

### Description

`agentcore add policy --enforcement-mode LOG_ONLY` persists the selected mode in `agentcore.json`, but the pinned `@aws/agentcore-cdk` package does not emit `EnforcementMode` on `AWS::BedrockAgentCore::Policy`. CloudFormation therefore uses the service default, `ACTIVE`, and a policy intended for shadow testing is enforced.

### Steps to Reproduce

1. Create an AgentCore project with a policy engine and gateway.
2. Add a policy with `--enforcement-mode LOG_ONLY`.
3. Run `agentcore deploy` or synthesize the vended CDK project.
4. Inspect the `AWS::BedrockAgentCore::Policy` resource.

### Expected Behavior

The synthesized policy contains `EnforcementMode: LOG_ONLY`.

### Actual Behavior

`EnforcementMode` is omitted, so the service defaults the policy to `ACTIVE`.

### CLI Version

0.25.0

### Operating System

Linux

### Additional Context

The L3 construct needs to model and synthesize per-policy enforcement mode first. After that fix is published, the CLI must bump its exact `@aws/agentcore-cdk` asset dependency and update snapshots.

Start by reproducing `agentcore add policy --enforcement-mode LOG_ONLY`, then run `agentcore deploy` or synthesize the vended CDK project and inspect the `AWS::BedrockAgentCore::Policy` resource. Trace how the value in `agentcore.json` reaches the pinned `@aws/agentcore-cdk` package; done means the published construct emits `EnforcementMode: LOG_ONLY`, the CLI bumps the exact dependency, and snapshots are updated.

Written by the indexing model from the issue text.