Test every guardrail limit and stop flagging dead-letter queues - #267

This is the second testing sweep for security inventories, guardrails and posture (slices S61, S62, S67). I broke the product code on purpose, one realistic fault at a time, and counted which faults a test noticed. The score goes from 34/52 to 52/52 across the three slices. The biggest gap was guardrails, at 2/14: stage, region, resource-type, container, engine, instance-size (read replicas), custom-domain, resource-count and dead-letter-queue limits could all be broken without any test failing. The 145-file CLI source suite also passed with every one of those faults applied.

The guardrail spec now has one table-driven scenario through the real ConfigManager. Each limit has to admit its boundary and the defaults normalization applies, block the first configuration past it, and pass the schema the Console uses when an admin saves the policy. The posture spec now includes an OpenSearch domain left at its default internet accessibility. The Trivy spec checks that a rejected download leaves no staging files behind. The MiniStack inventory scenario now deploys a fourth time, so choosing the oldest earlier inventory instead of the newest no longer goes unnoticed.

While writing the guardrail scenario I found a bug, which this PR fixes. The require-dead-letter-queue guardrail and the queue-without-dead-letter-queue posture rule also asked the dead-letter queue itself for a redrivePolicy. An organization with that guardrail could only deploy a queue with a dead-letter queue by making the two queues redrive into each other. The Console's suggested fix (add a dead-letter queue) also created a new finding for the queue it added. Queues that a stack queue names as its redrive target are now exempt from both rules. Both specs reproduced the bug before the fix.

I deleted the STACKTAPE_TRIVY_PATH unit test. The MiniStack inventory scenario runs through that override and fails when it is ignored. The Console side is stacktape/console-app#115. This PR does not move the Console pointer.

Checked locally (CI is off): cli-security-rules, the MiniStack inventory and deploy lanes, the CLI source suite (151 files) and smoke test, test:db --security and --insights, test:tools, and pnpm check:integrated up to turbo run test. That run stopped on two failures that also happen on clean origin/main, outside these slices: helper-lambda-sdk.spec.ts hits its 120 s timeout because packaging now compiles the code-swap benchmark three times, and fast-deploy.spec.ts counts 3 upload timeouts in the shared-layer scenario. I ran the gate's remaining steps on their own (build, tool types, pack, architecture, dead code, duplicates) and they pass. ministack-deploy passed except for that same fast-deploy.spec.ts case.

After review: the guardrail docs still said every queue needs a redrivePolicy, so they now describe the dead-letter queue exemption, and the generated LLM docs corpus is regenerated to match. The branch is merged with the latest main. pnpm check:integrated stops at the same helper-lambda-sdk.spec.ts timeout as before, which also happens on main. Everything before it passes, including docs and generation checks, and so do the later steps (build, tool types, pack, architecture, dead code, duplicates) run on their own.