feat(cloudwatch): support single-series alarm warm-up

[topra-aws]

Issue # (if applicable)

Closes #38743.

Reason for this change

CloudFormation supports delaying CloudWatch alarm evaluation after an alarm is created or updated, which helps prevent alarm noise while a resource begins publishing metric data. The generated CfnAlarm exposes this capability, but the existing alarm L2 APIs require users to reach through to the L1 construct.

Warm-up configuration is supported for alarms that evaluate one time series, including ordinary metric math, collapsed Metrics Insights queries, and anomaly detection. It is not supported for PromQL contributor alarms or direct multi-time-series Metrics Insights queries.

Description of changes

• Add a shared AlarmWarmupConfiguration with a strongly typed Duration and the option to wait for the complete warm-up period.
• Expose warmupConfiguration through Alarm, AnomalyDetectionAlarm, Metric.createAlarm, and MathExpression.createAlarm.
• Allow ordinary metric math, direct Metrics Insights queries without GROUP BY, and grouped Metrics Insights queries collapsed by an outer metric math expression.
• Reject a direct top-level Metrics Insights SELECT ... GROUP BY contributor alarm when warm-up is configured.
• Keep the option out of PromQLAlarmProps.
• Render the generated WarmUpConfiguration property and validate CloudFormation's 1–2880 whole-minute range while preserving unresolved tokens.
• Preserve backward-compatible synthesis when the option is omitted.
• Document the support matrix and add unit and integration coverage.

Generated L1 files such as cloudwatch.generated.ts are intentionally ignored and regenerated by spec2cdk; they must not be committed manually. The pinned @aws-cdk/aws-service-spec 0.1.208 generates both CfnAlarm.WarmUpConfigurationProperty and CfnAlarmProps.warmUpConfiguration. The temporary F3002 acknowledgement is for the separate CloudFormation validation schema, which currently lags the L1 service spec.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Refreshed dependencies from the frozen lockfile; @aws-cdk/aws-service-spec resolved to the pinned 0.1.208.
• Built aws-cdk-lib successfully twice after the final changes; jsii reported 0 errors and 0 warnings.
• Ran the full aws-cdk-lib lint command successfully; only pre-existing repository warnings were reported.
• Ran the focused Alarm and PromQLAlarm suites: 55 tests passed.
• Covered plain metrics, ordinary metric math, anomaly detection, direct single-series Metrics Insights, rejected direct grouped Metrics Insights, collapsed grouped Metrics Insights, escaped quoted query text, and tokenized expressions.
• Ran integ.alarm-warmup in dry-run mode; the snapshot was unchanged and passed.
• Ran git diff --check successfully.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license