chore(deps): clear 6 Dependabot alerts (aws/cdk brace-expansion, examples aiohttp/cryptography)

[kylehounslow]

What

Clears 6 of 10 open Dependabot alerts across the AWS install path and the example apps.

Alert	Package	Manifest	Advisory	Fix
#333	brace-expansion	aws/cdk	GHSA-mh99-v99m-4gvg	aws-cdk-lib 2.262.1 -> 2.263.0 (bundles brace-expansion 5.0.8)
#335	aiohttp	examples/agent-evals/genai-sdk	GHSA-mq44-7p77-q5h7	constrain aiohttp>=3.14.3
#336	aiohttp	examples/agent-evals/genai-sdk	GHSA-mfx4-hv73-q22v	constrain aiohttp>=3.14.3
#337	aiohttp	examples/agent-evals/genai-sdk	GHSA-cq5v-8q36-5273	constrain aiohttp>=3.14.3
#338	cryptography	examples/agent-evals/genai-sdk	GHSA-g6cj-pr64-35w5	constrain cryptography>=50.0.0
#339	cryptography	examples/strands/code-assistant	GHSA-g6cj-pr64-35w5	constrain cryptography>=50.0.0

Fix

aws/cdk: bump aws-cdk-lib floor to ^2.263.0. brace-expansion is a bundledDependency of aws-cdk-lib, so an npm override cannot rewrite it; the only fix is a cdk-lib release that bundles a patched version. 2.263.0 bundles brace-expansion 5.0.8 (was 5.0.7). Targeted bump against the existing lockfile, so the fast-xml-parser override and the rest of the tree are untouched.

examples: add aiohttp>=3.14.3 and cryptography>=50.0.0 to [tool.uv].constraint-dependencies, matching the existing idna/starlette pinning pattern. uv lock re-resolves both transitives to the patched versions.

Validation

• aws/cdk: npm run build (tsc) and npm run synth pass; aws-cdk CLI floats to 2.1135.0; lockfile shows bundled brace-expansion at 5.0.8; npm audit reports the single remaining high is chore(deps): bump dompurify from 3.4.5 to 3.4.12 in /docs/starlight-docs #334.
• genai-sdk: uv lock --check and uv sync --frozen pass; aiohttp resolves to 3.14.3, cryptography to 50.0.0.
• code-assistant: uv lock --check passes; cryptography resolves to 50.0.0.

Not fixed in this PR

• chore(deps): bump dompurify from 3.4.5 to 3.4.12 in /docs/starlight-docs #334 (brace-expansion GHSA-rgw5-rvv9-x895, patched in 5.0.9): still open. No published aws-cdk-lib release bundles brace-expansion 5.0.9; 2.263.0 (latest) bundles 5.0.8. Bundled deps cannot be overridden. Clears when a future aws-cdk-lib bundles 5.0.9.
• chore(deps): update dependency aws-cdk-lib to v2.250.0 #281, aws-cdk-lib-2.251.0.tgz: 8 vulnerabilities (highest severity is: 7.5) #293, vite-4.3.0.tgz: 2 vulnerabilities (highest severity is: 8.3) - autoclosed #294 (astro in docs/starlight-docs): all three require astro 7; the installed version is 6.4.8. This is a breaking major bump and is out of scope for a routine security sweep. Tracked separately for a dedicated astro 6 -> 7 migration.