feat(project): implement safe CDK deployment

[notgitika]

Summary

• resolve and validate one deployment target before backend dispatch
• resolve one CDK CLI-compatible credential provider and share it across STS, CloudFormation, and Toolkit operations
• reject credentials for the wrong AWS account before synthesis or mutation
• synthesize to a fixed assembly directory and select exactly one tagged stack
• bootstrap only absent or stably outdated environments, propagating unsafe and ambiguous states
• deploy through the backend-local Toolkit adapter and return stack outputs
• embed and clean up the Toolkit bootstrap template for standalone executables

Stack

This is PR 4 of 4 decomposing #2001 and is the first PR in the stack that activates deployment. Review and merge bottom-up.

1. refactor(project): move build behind a project backend #2055 - backend build boundary
2. feat(project): add deploy command contract #2056 - deploy command contract
3. feat(project): add CDK Toolkit adapter #2057 - CDK Toolkit adapter
4. feat(project): implement safe CDK deployment #2058 - safe deployment implementation (this PR)

Follow-ups

• Revisit and document the inherited createCustomerMasterKey: true bootstrap policy, including recurring KMS cost and security rationale. This PR preserves the shipped CLI behavior.
• Define confirmation and ownership semantics before changing shared CDKToolkit stacks, including externally managed bootstrap infrastructure tracked by Hard-coded CDKToolkit stack name causes false bootstrap prompt #1799.

typecheck, lint, format, test all pass
did npm bundle and standalone executable smoke tests

[codecov-commenter]

Codecov Report

❌ Patch coverage is 90.45643% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.08%. Comparing base (d5e69ff) to head (9d9e7f6).

Files with missing lines	Patch %	Lines
src/core/project/backends/cdk/environment.ts	72.97%	20 Missing ⚠️
src/core/project/backends/cdk/toolkit.ts	93.02%	3 Missing ⚠️

Additional details and impacted files

@@                     Coverage Diff                      @@
##           feat/project-cdk-toolkit    #2058      +/-   ##
============================================================
- Coverage                     97.15%   97.08%   -0.08%     
============================================================
  Files                           388      390       +2     
  Lines                         23202    23427     +225     
============================================================
+ Hits                          22543    22745     +202     
- Misses                          659      682      +23     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.