[FIX] Harden SageMaker notebook defaults in CFN templates

[oussamahansal]

Description

Harden the NeptuneNotebookInstance defaults across all 9 lexical-graph CloudFormation templates

Changes

• RootAccess: Disabled
• New optional NotebookKmsKeyId parameter + HasNotebookKmsKeycondition; KmsKeyId set to the CMK when provided (empty default)

Problem

Related issue (if any): #

Testing

• Unit tests added/updated
• Integration tests added (as appropriate)
• Existing tests pass (pytest)
• Tested manually (describe below)

Checklist

• Code follows existing style and conventions
• License headers present on new files
• Documentation updated (if applicable)
• No breaking changes (or clearly documented)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[noel-improv]

lgtm just a couple of comments:

• The body lists only RootAccess and the KMS parameter, but the two changes with real deployment impact are DirectInternetAccess: Disabled and the subnet move. Both force a notebook replacement on a stack update and drop its public IP.
• Question: With egress now forced through NAT, S3 and Bedrock traffic bills at the NAT data-processing rate. An S3 gateway endpoint is free, might be worth adding while the templates are open?
• Nit: NotebookKmsKeyId takes any string, so a typo fails mid-create instead of at parameter validation. An AllowedPattern would catch it.

[oussamahansal]

• Question: With egress now forced through NAT, S3 and Bedrock traffic bills at the NAT data-processing rate. An S3 gateway endpoint is free, might be worth adding while the templates are open?

Keeping this PR scoped to the fix rather than expanding the VPC resources here we can do that in another pr

[mykola-pereyma]

The hardening itself is correct and consistent where applicable (RootAccess + KMS on all 9; DirectInternetAccess + public→private subnet on the self-contained VPC templates). Requesting changes to confirm three functional points are covered — inline. Separately, the PR description still only lists RootAccess + KMS; please also add the DirectInternetAccess: Disabled and public→private subnet changes (they change the notebook's network reachability).