Add guardrail checklist for foundation changes

[arjunmehta-git]

Capture the minimum guardrails expected for cloud foundation work, including tagging, logging, encryption, and change review requirements.

[hamza-mohd]

Both. PR template for the manual checks. For automatable ones - let's add checkov to CI so it fails the PR before human review ever happens.

[arjunmehta-git]

Agreed. Checkov covers Terraform and CloudFormation, which we may add later. I'll wire up the GitHub Actions workflow.