chore(deps-dev): bump the minor-and-patch group in /infra with 3 updates

Bumps the minor-and-patch group in /infra with 3 updates: [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk), [constructs](https://github.com/aws/constructs) and [tsx](https://github.com/privatenumber/tsx).


Updates `aws-cdk` from 2.1134.0 to 2.1135.1
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1135.1/packages/aws-cdk)

Updates `constructs` from 10.7.2 to 10.8.1
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](https://github.com/aws/constructs/compare/v10.7.2...v10.8.1)

Updates `tsx` from 4.23.1 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.11)

---
updated-dependencies:
- dependency-name: aws-cdk
  dependency-version: 2.1135.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: constructs
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -13,8 +13,6 @@ updates:
         patterns:
           - 'vitest'
           - '@vitest/*'
-    commit-message:
-      prefix: 'chore(deps)'
   - package-ecosystem: 'npm'
     directory: '/infra'
     schedule:
@@ -28,8 +26,6 @@ updates:
         patterns:
           - 'vitest'
           - '@vitest/*'
-    commit-message:
-      prefix: 'chore(deps)'
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
@@ -39,5 +35,3 @@ updates:
         update-types:
           - 'minor'
           - 'patch'
-    commit-message:
-      prefix: 'chore(deps)'

.github/workflows/ci.yaml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@7ac3528750b346f181347bb09f6af927a1c0aa14 # v1.0.6
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3
     with:
       node-version: '24'
       enable-qemu: true

.github/workflows/dependency-review.yml

@@ -7,4 +7,4 @@ permissions:
 
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@7ac3528750b346f181347bb09f6af927a1c0aa14 # v1.0.6
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3

.github/workflows/deploy.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@7ac3528750b346f181347bb09f6af927a1c0aa14 # v1.0.6
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3
     with:
       node-version: '24'
       enable-qemu: true

.github/workflows/labeler.yaml

@@ -10,4 +10,4 @@ permissions:
 
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@7ac3528750b346f181347bb09f6af927a1c0aa14 # v1.0.6
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3

.github/workflows/policy.yaml

@@ -1,22 +0,0 @@
-name: PR Policy
-
-on:
-  pull_request:
-    types: [opened, reopened, synchronize, edited, labeled, unlabeled, ready_for_review]
-
-concurrency:
-  group: "policy-${{ github.event.pull_request.number }}"
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
-
-jobs:
-  policy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-pr-policy.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
-    secrets:
-      JIRA_CLOUD_ID: ${{ secrets.JIRA_CLOUD_ID }}
-      JIRA_SERVICE_ACCOUNT_EMAIL: ${{ secrets.JIRA_SERVICE_ACCOUNT_EMAIL }}
-      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

AGENTS.md

@@ -1,25 +0,0 @@
-# AGENTS.md
-
-## Sea Haven Governance
-
-**Standards authority**: The engineering handbook is the single authority for coding standards, naming conventions, and workflow configuration. Do not justify changes by citing it in PR bodies.
-
-**Work authority**: Jira is the source of truth for work status. Before creating a ticket, search Jira for duplicates. Route product work to DEV, infrastructure and platform work to PLAT, and security work to SEC.
-
-**Branch names**: Use `feature/`, `fix/`, `hotfix/`, `chore/`, `docs/`, `refactor/`, or `release/` with a kebab-case description. Do not include Jira keys in branch names. Dependabot branches and emergency reverts are exempt from this rule.
-
-**PR title format**: `type(scope): description (DEV-123)` — Jira key required on every non-exempt PR. Dependabot and permission-controlled emergency reverts are exempt.
-
-**PR body headings** (exact, in this order):
-1. Summary
-2. Validation
-3. Tests
-4. Notes
-
-**Prohibited**: AI-attribution footers in commits, PRs, comments, or generated artifacts.
-
-**Security gates**:
-- PRs touching payment flows, authentication logic, secret handling, AWS IAM, or untrusted user input require security review.
-- IAM role, policy, or resource-permission changes require cross-family review.
-
-**CI workflow refs**: All `uses:` workflow refs must be pinned to a full commit SHA with an inline version comment — `owner/repo/.github/workflows/file.yaml@<full-sha> # vX.Y.Z`. No floating tags or branch refs.