fix(ab-test): validate bundle promotion before stopping

[proton0210]

Description

Closes #2526.

Config-bundle promotion previously declared preflight successful without fetching the winning version. Only after stopping the test did it fetch and write components, including payloads that cannot fit the pinned CDK construct's CfnJson response.

• Fetch and validate the winner before stopping, measuring UTF-8 serialized response data with resolved keys and the construct's PascalCase mapping.
• Use an explicitly documented conservative 3072-byte response-data budget, reserving 1024 bytes of the 4096-byte total for CloudFormation response metadata. This is not a ConfigurationBundle API limit or an exact guarantee for every response envelope; it intentionally rejects some payloads below 4 KiB. It is tied to the current pinned construct and should be revisited when its CfnJson dependency is removed.
• Apply the same validated payload after stopping without a second service fetch.
• Reread the project before writing, preserve unrelated edits, and refuse to overwrite a bundle changed since preflight. Report the stopped state if application then fails.
• Document the guard and add handler-level side-effect/order regressions alongside size-boundary tests.

This is a promotion safety guard; it does not fix the underlying CDK deployment-size limitation in #2518 or raise the supported payload size.

Type of Change

• Bug fix
• Documentation update (in this PR; no separate documentation PR)

Testing

• Before the fix: three new regressions failed (preflight fetch and oversized UTF-8 payloads on both dry-run/write paths).
• Focused promotion suite: 24 passed, including exact byte boundaries, multibyte prompts, JSON escaping, multiple components, fetch failure, no stop/no write on rejected preflight, single-fetch ordering, portable keys, concurrent edits, and existing target-based behavior.
• Final full npm test: 6,363 passed across 441 files. Selected offline CLI integration tests (integ-tests/help.test.ts and integ-tests/config.test.ts): 30 passed.
• Build, typecheck, and lint pass; repository lint has 35 existing warnings and no errors. Normal commit hooks check changed-file lint, formatting, secrets, and typecheck.
• Three audit passes: root cause/failing regressions and pinned construct mapping; side effects/compatibility/concurrent edits; final suite/build/lint/diff and scope review.

All service interactions were mocked. No live A/B test was stopped, no project was promoted in AWS, and no deployment or paid invocation was performed. The full integration suite was not run.

Checklist

• Read CONTRIBUTING and linked the existing issue
• Added regression tests and updated the relevant documentation
• No dependency changes or new warnings
• Independent of the deployment-diagnostics PR

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.