Add observability hygiene cost rules

What

Rules for observability spend that outlives its usefulness: alarms stuck in INSUFFICIENT_DATA, Synthetics canaries running against dead or perpetually failing targets, and AWS Config recording high-churn resource types.

Why

Observability costs grow monotonically by default. An alarm whose metric disappeared bills $0.10/mo forever while alerting on nothing; a canary hammering a decommissioned endpoint pays per run for no signal; Config recording ephemeral high-churn types (Spot/ASG-heavy accounts) generates configuration-item charges that quietly dominate the Config bill.

Details

1. CloudWatch alarm in INSUFFICIENT_DATA state for the full lookback window (metric gone/broken) — discovery; extends cloudwatch/ as CLDBRN-AWS-CLOUDWATCH-4.
2. Synthetics canary with a 100% failure rate over the lookback window — discovery; research whether it lives in cloudwatch/ or a synthetics/ module.
3. AWS Config recorder with AllSupported: true (or explicitly including high-churn ephemeral types) — discovery + IaC review; new config/ module — settle the service short-name (config vs configservice) against the ID convention during research.

• Framed as hygiene: flag paying-for-nothing states, never recommend reducing genuine monitoring coverage.

Start by reading the existing cloudwatch/ rules and their ID convention, then investigate whether Synthetics belongs there or in a new synthetics/ module. Review the proposed config/ module and settle the service short-name against existing conventions. Done means the three paying-for-nothing states are detected without recommending reduced monitoring coverage.