[Feature Request] No research blueprint family — the README names universities as a target audience, every blueprint is FedRAMP High, FedRAMP Moderate or IL5

## Feature Description
A `blueprints/research/` family for the unspecified regime, aimed at universities and research institutions.

## Use Case
The README lists "Educational and Research Institutions" under Target Audience. Every shipped blueprint targets FedRAMP High, FedRAMP Moderate or IL5. A university running NSF or NIH work usually has no Assured Workloads requirement, so it pays the compliance overhead and gets nothing back.

Three gaps show up on every deployment I do:

1. **Egress.** Researchers run `pip install`, pull from HuggingFace, and fetch datasets from Zenodo and nf-core. An inspected-egress topology blocks all of it. Per-spoke Cloud NAT lets it through.
2. **Who creates projects.** Central IT on the critical path for every new principal investigator (PI) project works for ten researchers and fails at hundreds.
3. **Blast radius.** A PI who needs a public IP for one sandbox VM shouldn't need an org-wide policy change.

## Proposed Solution
A blueprint family covering: NCC egress (see #58), department folders with tag-scoped org-policy delegation (see #14), sandbox and hardened folder presets (see #12), and project templates for each.

I have all of it deployed in a fork and can contribute it. Opening this first to check you want the family at all, and where it should live, before sending PRs against the three issues separately.

## Compliance & Deployment Context
* **Target Deployment Type(s):**
* [x] All / General — specifically the unspecified regime, where no Assured Workloads folder is created.
* **Relevant NIST 800-53r5 Controls:** Not compliance-driven. The delegation piece touches AC-6 (least privilege) by replacing org-wide policy admin with folder-scoped grants.

## Reusability Check
* [x] I have checked if this functionality can be achieved by extending an existing module or blueprint.
* [x] I have verified that this does not duplicate existing functionality.

## Alternatives Considered
Leaving it in its current fork.

## Additional Context
Related: #58, #14, #12.