feat: align the python starter kit with the typescript one (#20)

* feat: align the python starter kit with the typescript one

Brings the Python kit up to the feature set and structure of
aws-cdk-starter-kit, which has been the one getting the new features.

Structure:
- src/aspects: permission boundary, S3 encryption, S3 public access and
  RFC 1918 VPC CIDR aspects, with a README.
- src/stacks: FoundationStack (deploy role + CDK toolkit cleaner) and
  StarterStack replace GitHubOIDCStack and BaseStack.
- src/custom_constructs: the OIDC role moves out of the stack into
  GitHubActionsOidcConstruct. The folder keeps its name because a
  src/constructs package would shadow the constructs pip package.

Deployments:
- EnvironmentConfig replaces the target_accounts dict. Environments are
  test (branch deploys on) and production, deployed in list order.
- Branch deployments: GIT_BRANCH_REF names stacks after the branch,
  express mode on ephemeral test stacks, and a destroy workflow on
  branch deletion. FoundationStack is skipped for branch deploys.
- Tasks gain :all/:stack variants plus ls and branch-only hotswap.

CI:
- build.yml runs ruff, ty, pytest and synth on every PR, with projen's
  self-mutation push. Nothing ran tests in CI before.
- cdk-diff-pr-comment posts a diff on pull requests.
- release.yml tags and publishes when the project version changes.
- The CDK CLI comes from the pinned aws-cdk-cli PyPI package instead of
  npm install -g aws-cdk, so the cdk_cli_version pin is real.

Two places where a literal port would have broken:
- BucketPublicAccessAspect catches the ValueError jsii raises when
  reading a struct set from the TypeScript side, which every bucket
  built through the Bucket L2 construct hits.
- The destroy workflow filters branches in the job condition, because
  GitHub ignores a branches filter on delete events.

BREAKING CHANGE: the deploy role is now named GitHubActionsServiceRole
rather than GitHubDeployRole, and the dev:* tasks and cdk-deploy-dev
workflow are replaced by test:* and production:*.

* refactor: apply simplify review findings

Reuse and altitude reviewers both flagged the deploy role name being
retyped in .projenrc.py while the construct kept its own default. Two
sides must agree on it: FoundationStack creates the role and the
generated workflows put its ARN in role-to-assume. env_helper now owns
DEFAULT_GITHUB_DEPLOY_ROLE_NAME and both import it. DEFAULT_ENVIRONMENT
gets the same treatment.

That required env_helper to stop importing projen at runtime, since the
CDK app imports it for create_env_resource_name. The annotation moves
under TYPE_CHECKING, so synthesis no longer drags the build tool in.

Also from the reviews:
- .projenrc.py builds the task env dict once instead of repeating four
  of five keys for the branch variant.
- TRAILING_HYPHENS and TRAILING_NON_ALPHANUMERIC collapse into one
  TRAILING_SEPARATORS pattern; every string they trim is drawn from the
  same alphabet, so they did the same job.
- _create_cdk_deployment_workflow drops chained_on_previous_environment,
  which only duplicated whether triggers carries workflow_run, and the
  unreachable -1 fallback on the environment index.
- BucketPublicAccessAspect flattens its nested if/else into guard
  clauses matching the rest of the function.
- app.py tags branch deploys with extract_cleaned_branch_name directly
  rather than calling create_env_resource_name("b") for its suffix
  logic. The tag is now "add-api" rather than "b-add-api".

Generated workflows are byte-identical, confirming the cicd_helper
changes are behavior-preserving.

* chore: drop dependency auto-approval and gate releases by age

Nothing merges a dependency bump on its own any more. auto_approve_options
and the auto-merge override are gone, which removes .github/workflows/
auto-approve.yml, and the "auto-approve" label goes with them since it no
longer triggers anything. Dependabot still opens grouped weekly PRs; they
now wait for a human.

Adds the uv equivalent of the TypeScript kit's pnpm minimumReleaseAge:
tool.uv.exclude-newer = "7 days" makes resolution skip anything published
in the last week, so a compromised or broken release has time to be caught
and yanked. uv takes a rolling duration, so there is no timestamp to
maintain. Only `uv lock` resolves; the deploy workflows run
`uv sync --frozen` and are unaffected.

The versions this file pins needed exempting. exclude-newer applies to
explicit pins too, so pinning a CDK release on its publication day made
resolution fail outright rather than just holding back an upgrade
(aws-cdk-lib==2.263.0 hit exactly this). tool.uv.exclude-newer-package
sets "0 days" for each, and PINNED_PACKAGES now feeds both that and the
Dependabot ignore list, which previously named aws-cdk rather than the
aws-cdk-cli package this project actually depends on and missed pytest.

* chore: move projen and pytest to the newest gate-eligible releases

projen 0.99.62 -> 0.101.20 and pytest 9.0.3 -> 9.1.1. Both are the newest
releases at least MINIMUM_RELEASE_AGE_DAYS old, so `uv lock` resolves them
without any exclude-newer-package exemption. aws-cdk-lib stays on 2.254.0.

  aws-cdk-lib  2.254.0    80 days
  aws-cdk-cli  2.1130.0   23 days
  projen       0.101.20    8 days
  pytest       9.1.1      43 days

pytest never needed reverting: 9.1.1 is 43 days old and always cleared the
gate. Only aws-cdk-lib 2.263.0 ever tripped it.

Regenerating under 0.101.20 drops the auto-generated step `id:` fields that
0.101.23 emits. Cosmetic only; every id referenced by an output or a step
condition is set explicitly and is unchanged.

* docs: rewrite the readme prose

The feature list sold the kit instead of describing it ("Production-ready",
"Seamless Security", "enterprise-ready", "Ship-ready"). Every bullet now
names what the thing actually does, so a reader can tell whether they want
it. The Project Structure section opened with four paragraphs of throat
clearing before the tree; it's two sentences now, and they say why a single
stack stops working rather than that modularity is good.

Fixes three things that were wrong rather than just wordy:

- Step 3 told you to `npm install -g aws-cdk`. The CDK CLI comes from the
  aws-cdk-cli PyPI package in the lockfile now, so `uv sync` covers it.
  Removing that step renumbered the rest, and step 6 pointed at the wrong
  one for account setup.
- `cdk bootstrap` in step 7 assumed a global install that no longer exists,
  so it's `uv run cdk bootstrap`.
- Step 7 ended in a stray double bracket.

Leaves the TIP-LIST block alone, since that's synced across repos.

Author: dannysteenman