feat(core): plugin violations can be suppressed

[kaizencc]

Reason for this change

Part of the Validations RFC. Enables suppression of validation plugin findings via Validations.of().acknowledge(). Reroll of #37781

Description of changes

• collectAcknowledgedRuleIds() walks the construct tree collecting acknowledged rule IDs from metadata
• After all plugins report, violations matching acknowledged IDs are filtered out
• Rule matching: <pluginName>::<ruleName> (e.g. CfnGuardValidator::S3_BUCKET_VERSIONING)
• Fatal violations (severity === 'fatal') cannot be suppressed
• Works for any plugin — no dependency on the default validation engine

Usage

Validations.of(myConstruct).acknowledge({
  id: 'CfnGuardValidator::S3_BUCKET_VERSIONING',
  reason: 'Handled by org-level policy'
});

Description of how you validated changes

• tsc --noEmit passes
• 41 validation tests pass (2 new: suppression works, fatal cannot be suppressed)

Checklist

• My code adheres to the CONTRIBUTING GUIDE

[github-actions]

⚠️ The following issue reference(s) in your PR description are not valid issues:

• feat(core): suppression filtering for plugin violations #37781 (is a pull request, not an issue)

Please make sure your PR references an existing issue using the format Closes #123.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-05-11 14:46 UTC · Rule: default-squash
• ✅ Checks passed · in-place
• ✅ Merged — 2026-05-11 16:19 UTC · at 604bcdf70c6a9fab04b87eb9c3c7fe69b83bf25d · squash

This pull request spent 1 hour 33 minutes 12 seconds in the queue, including 31 minutes 30 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(core): plugin violations can be suppressed #37808
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(core): plugin violations can be suppressed #37808
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.