CI: compile/synth the CDK sample (not just parse it)

[alphacrack]

Summary

The CDK sample's package.json pins aws-cdk-lib and gets periodic Dependabot bumps, but there's no CI step that actually compiles the CDK sample (cdk synth / tsc). Add a lightweight check so a broken sample is caught.

Why

samples/cdk/ is used by the smoke test via --scan-only (which just parses index.ts as text), so a sample that no longer compiles would still pass smoke. The iac-scanner-cdk-nag companion actually runs cdk synth, so a broken sample breaks that path silently.

What to do

• Add a CI job (or extend an existing one) that runs npm ci && npx cdk synth (or tsc --noEmit) in samples/cdk/.
• Keep it non-blocking initially if flakiness is a concern, then promote to required.

Acceptance criteria

• CI compiles/synths the CDK sample.
• A deliberately-broken index.ts would fail the job (verify locally).

Good first issue notes

Touches CI + a bit of Node tooling. Moderate. area:ci, iac:cdk. Good if you're comfortable with npm/CDK.