E8. Guardrails (tags, regions, exposure)

Implement 'real' controls.
**Tag Enforcement:** CI check for Owner/CostCenter/DataClass.
**Region Allowlist:** CI check.
**Exposure:** Enforce IP allowlist/auth proxy if access_mode=corporate-only.
**FinOps:** Sizing cost drivers and budget alerts.