aws-cdk-lib 2.263.0 still ships brace-expansion 5.0.8 inBundle; npm cannot override it. Document accepted synth-time risk until upstream rebundles >=5.0.9.
