[AWS] Implement the foundational environment network slice #53

Outcome

Support safe existing-network references and the selected managed network resources.

Scope

• Implement the approved VPC, subnet, route, security-group, endpoint, and ownership slice with deterministic plans.

Acceptance criteria

• Referenced infrastructure cannot be deleted as owned state.
• Routes and security rules are least privilege.
• NAT or other recurring-cost resources are opt-in with plan-time cost warnings.

Test and evidence

• Conformance, ownership, least-privilege, and cost-plan tests.

Dependencies

• Blocked by #52.
• Blocked by #42.
• Blocked by #43.

References

• Architecture overview
• Security model