feat(infra): shared SNS alarm-notification plane (wire bare CloudWatch alarms) — AC5 of #284

[scottschreckengaust]

Parent context: deferred AC5 of #284 (surfaced during PR #674 review by @theagenticguy). Needs maintainer approved before implementation (ADR-003).

Finding

Every CloudWatch alarm in cdk/src is a bare alarm with no notification action — nothing pages an operator; the signal is only visible to someone already watching the CloudWatch console. Current bare alarms:

• WebhookProcessorDlqDepthAlarm + WebhookProcessorErrorAlarm (github-screenshot-integration.ts)
• FanOutConsumer.dlqDepthAlarm (fanout-consumer.ts)
• OrchestratorErrorAlarm (task-orchestrator.ts)
• ApprovalMetricsPublisherConsumer alarm (approval-metrics-publisher-consumer.ts)

#284's AC5 asked for notification. PR #674 deliberately did not one-off an SNS topic on the webhook alarm (correct restraint — a per-alarm topic would be the wrong shape), and #674 therefore uses Refs #284, leaving #284 open for this.

Scope

• Stand up a shared SNS notification plane (one topic, or a small construct) that alarms across the app can wire an addAlarmAction to.
• Retrofit the existing bare alarms above to publish to it.
• Decide subscription delivery (email/chatbot/PagerDuty) as a config input, not hardcoded.
• Consider cdk-nag implications + a documented subscription-management runbook.

Closes

This satisfies #284's AC5. Once shipped, #284 can close (it is currently held open as DONE-NO-CLOSE tracking exactly this gap).

Refs #284